Lateral Movement Detection for Network Security Analysis

ABSTRACT

A security platform employs a variety techniques and mechanisms to detect security related anomalies and threats in a computer network environment. The security platform is “big data” driven and employs machine learning to perform security analytics. The security platform performs user/entity behavioral analytics (UEBA) to detect the security related anomalies and threats, regardless of whether such anomalies/threats were previously known. The security platform can include both real-time and batch paths/modes for detecting anomalies and threats. By visually presenting analytical results scored with risk ratings and supporting evidence, the security platform enables network security administrators to respond to a detected anomaly or threat, and to take action promptly.

This application claims the benefit of U.S. provisional patentapplication No. 62/212,541 filed on Aug. 31, 2015, and titled “NetworkSecurity System,” which is incorporated by reference herein in itsentirety.

A portion of the disclosure of this patent document contains materialwhich is subject to copyright protection. The copyright owner has noobjection to the facsimile reproduction by anyone of the patent documentor the patent disclosure, as it appears in the Patent and TrademarkOffice patent file or records, but otherwise reserves all copyrightrights whatsoever.

FIELD OF THE INVENTION

At least one embodiment of the present disclosure pertains todistributed data processing systems, and more particularly, tointelligence generation and activity discovery from events in adistributed data processing system.

BACKGROUND

Activity detection, both friendly and malicious, has long been apriority for computer network administrators. In known public andprivate computer networks, users employ devices such as desktopcomputers, laptop computers, tablets, smart phones, browsers, etc. tointeract with others through computers and servers that are coupled tothe network. Digital data, typically in the form of data packets, arepassed along the network by interconnected network devices.

Unfortunately, however, malicious activities can cause harm to thenetwork's software or hardware, or its users. Malicious activities mayinclude unauthorized access or subsequent unpermitted use of networkresources and data. Network administrators seek to detect suchactivities, for example, by searching for patterns of behavior that areabnormal or otherwise vary from the expected use pattern of a particularentity, such as an organization or subset thereof, individual user, IPaddress, node or group of nodes in the network, etc.

Security appliances are used in known systems to provide networksecurity. The appliance approach involves installing security appliances(which are typically servers or computers configured for providingsecurity) at one or more locations in the network. Once installed, theappliance monitors traffic that traverses the network. Functionsprovided by the appliance may include malware detection, intrusiondetection, unauthorized access or unauthorized use of data, amongothers. Unfortunately, security appliances cannot easily be scaled tohandle temporary or permanent increases in network traffic. Increasednetwork traffic often requires a security vendor to perform an applianceswap or an equally time-consuming appliance upgrade. Appliances alsotend to have only limited network visibility because they are typicallyconfigured to monitor data traversing the link on which a respectiveappliance is installed only. Such an appliance will be unaware ofactivities occurring on other network segments monitored by otherappliances and thus cannot use the additional context informationpertaining to activities occurring on other network segments to detect acleverly-designed piece of malware that may be difficult to detect frompurely localized information.

Installed software products, rather than security hardware appliances,provide another approach to security for data networks. These products,such as anti-virus or anti-malware software, typically are installed onterminal devices (e.g., desktop and laptop computers, tablets, or smartphones). Data traversing the network between the terminal device ismonitored by the installed products to detect malware in either inboundor outbound data. Unfortunately, installed software products also do notperform well in terms of scalability or network visibility. Installedproducts tend to be disposed locally on the terminal devices and thusalso tend to have fairly localized views of the data on the network.They also tend to be installed on hardware that cannot be upgradedeasily.

BRIEF DESCRIPTION OF THE DRAWINGS

Certain embodiments of the present disclosure are illustrated, by way ofexample, in the figures of the accompanying drawings, in which likereferences indicate similar elements.

FIG. 1 shows a general environment in which a security platform, whichis an example application of a data processing system introduced here,may be implemented.

FIG. 2 shows an example of functional layers of a security platform.

FIG. 3 shows a high-level view of an example of the processing withinthe security platform.

FIG. 4 shows an example of the architecture of the security platform.

FIG. 5 shows an example implementation of the real-time processing pathin greater detail.

FIG. 6 shows an example representation of the process of buildingadaptive behavioral baselines and evaluating against such baselines tosupport the detection of anomalies.

FIGS. 7A and 7B collectively show a table listing example types ofmachine data that can be found in different environments.

FIG. 8 shows an example implementation of the data intake andpreparation stage of the security platform.

FIG. 9A shows raw event data received by the data intake and preparationstage

FIG. 9B shows an event-specific relationship graph based on the eventshown in FIG. 9A.

FIG. 10 shows an example implementation of an identity resolutiontechnique based on the information in the events.

FIG. 11 shows a diagram of a technique for providing a uniform accessinterface (“event view”) at the data intake and preparation stage for anevent processing engine (e.g., at a subsequent stage) to obtain relevantinformation from various kinds of machine data.

FIG. 12 shows a table of example uniform access interfaces (“eventviews”) that can be implemented in the data intake and preparationstage.

FIGS. 13A and 13B collectively show a table including example anomaliesthat can be identified by machine learning models and/or other types ofprocessing entities, and various example uniform access interfaces andfields that can be used by the models/entities to receive relevantinformation about the events for performing further analytics.

FIG. 14 shows a sessionization technique that can be implemented at thedata intake and preparation stage.

FIG. 15 is a block diagram of a machine learning-based complex eventprocessing (CEP) engine.

FIG. 16 is a block diagram illustrating an architectural framework of amachine learning model.

FIG. 17 is a block diagram illustrating an example of the model typedefinition.

FIG. 18 is a block diagram illustrating an example system architecturefor implementing the distributed computation system.

FIG. 19 is a flow diagram illustrating a method to execute a modelpreparation process thread.

FIG. 20 is a flow diagram illustrating a method to execute a modeltraining process thread.

FIG. 21 is a flow diagram illustrating a method to execute a modeldeliberation process thread.

FIG. 22 shows a diagram of an example architecture of the securityplatform in which sharing of model state between real-time and batchprocessing paths can be implemented.

FIG. 23 is flow diagram illustrating at a high level, the processinghierarchy of detecting anomalies, identifying threat indicators, andidentifying threats.

FIG. 24 is flow diagram illustrating in more detail an example processfor detecting anomalies, identifying threat indicators, and identifyingthreats to network security.

FIG. 25 is a flow diagram describing an example process for detectinganomalies.

FIG. 26 is a flow diagram describing an example process for identifyingthreat indicators.

FIG. 27 shows a first use case for identifying threat indicators basedon entity associations with detected anomalies.

FIG. 28 shows a second use case for identifying threat indicators basedon entity associations with detected anomalies.

FIG. 29 illustrates a use case for identifying threat indicators basedon duration of detected anomalous behavior.

FIG. 30 illustrates a use case for identifying threat indicators basedon local and global rarity analysis.

FIG. 31A illustrates identification of a threat indicator according to afirst use case based on combining the outputs from different anomalymodels.

FIG. 31B illustrates nonidentification of a threat indicator accordingto the first use case based on combing the outputs from differentanomaly models.

FIG. 32A illustrates identification of a threat indicator according to asecond use case based on combining the outputs from different anomalymodels.

FIG. 32B illustrates nonidentification of a threat indicator accordingto the second use case based on combing the outputs from differentanomaly models.

FIG. 33 illustrates a use case for identifying threat indicators byenriching the anomaly data using data from external sources.

FIG. 34 is a flow diagram describing an example process for identifyingthreats to network security based on threat indicators.

FIG. 35 illustrates an example process of combining and storingevent-specific relationship graphs into a composite relationship graph.

FIG. 36 illustrates an example of a composite relationship graph.

FIG. 37 illustrates an example of how a composite relationship graph canbe stored as separate projections.

FIG. 38 illustrates a sample process of combining event-specificrelationship graphs into a composite relationship graph and detecting asecurity threat based on the composite relationship graph.

FIG. 39A is an illustrative home screen in a GUI of a system formonitoring potential computer network compromise, in accordance withvarious embodiments of the disclosure.

FIG. 39B is an illustrative screen in the GUI of FIG. 39A, depicting anexpanded view of a “Views” tab selector, which enables a GUI user toselect between viewing screens identifying instances of potentialnetwork compromise and viewing screens identifying entities associatedwith the instances of potential network compromise, in accordance withvarious embodiments of the disclosure.

FIG. 40A is an illustrative view in the GUI of FIG. 39A of a “ThreatsReview” screen for reviewing identified threats, in accordance withvarious embodiments of the disclosure.

FIG. 40B is an illustrative view of an expanded “Threat Types” selectorfor filtering the “Threats Review” screen of FIG. 40A to display only aselected type of threat, in accordance with various embodiments of thedisclosure.

FIG. 40C is an illustrative view of an expanded “Actions” tab in the“Threats Review” screen of FIG. 40A, in accordance with variousembodiments of the disclosure.

FIG. 40D is an illustrative view of a “Threat Relations” diagram and a“Kill Chain” diagram, which are generated upon clicking the “Details”tab in the “Threats Review” screen of FIG. 40A, in accordance withvarious embodiments of the disclosure.

FIG. 40E is an illustrative view of a “Threat Anomalies Timeline,”“Threat Anomalies Trend,” and “Threat Anomalies” listing, which aregenerated upon clicking the “Details” tab in the “Threats Review” screenof FIG. 40A, in accordance with various embodiments of the disclosure.

FIG. 40F is an illustrative view of a “Device Locations” map, which isgenerated upon clicking the “Details” tab in the “Threats Review” screenof FIG. 40A, in accordance with various embodiments of the disclosure.

FIG. 40G is an illustrative view of a text bubble generated uponhovering a cursor over a device location in the “Device Locations” mapof FIG. 40F, in accordance with various embodiments of the disclosure.

FIG. 40H is an illustrative view of a text bubble generated uponhovering a cursor over a line drawn between devices in the “DeviceLocations” map of FIG. 40F, in accordance with various embodiments ofthe disclosure.

FIG. 41 is an illustrative view of a “User Facts” screen in the GUI ofFIG. 39A, in accordance with various embodiments of the disclosure.

FIG. 42 is an illustrative view of an “Anomalies Table” screen in theGUI of FIG. 39A, in accordance with various embodiments of thedisclosure.

FIG. 43 is an illustrative view of an “Anomaly Details” screen in theGUI of FIG. 39A, in accordance with various embodiments of thedisclosure.

FIG. 44A is an illustrative view of an expanded “Watchlists” tab in the“Threats Review” screen of FIG. 40A, in accordance with variousembodiments of the disclosure.

FIG. 44B is an illustrative view of an “Anomaly Details” screen in theGUI of FIG. 39A, including a “Watchlists” designation, in accordancewith various embodiments of the disclosure.

FIG. 45A is an illustrative view of a “Threats Table” screen in the GUIof FIG. 39A, in accordance with various embodiments of the disclosure.

FIG. 45B is an illustrative view of a “Threats Trend” as a line chart.

FIG. 45C is an illustrative view of a “Threats Trend” as a column chart.

FIG. 45D is an illustrative view of a text bubble generated uponhovering a data point in the “Threats Trend” diagram of FIG. 45A, inaccordance with various embodiments of the disclosure.

FIG. 45E is an illustrative view of a “Threats Details” screen in theGUI of FIG. 39A, in accordance with various embodiments of thedisclosure.

FIG. 46A is an illustrative view of an “Anomalies Table” screen in theGUI of FIG. 39A, in accordance with various embodiments of thedisclosure.

FIG. 46B is an illustrative view of the “Anomalies Trend” and the“Anomalies” listing in the “Anomalies Table” screen of FIG. 46A,depicting a selection of a data point in the “Anomalies Trend” diagram.

FIG. 46C is an illustrative view of a portion of an “Anomalies Details”screen for a selected anomaly in the GUI of FIG. 39A, including a“Users” section, “Anomaly Relations” section, and “Triggering Event”section, in accordance with various embodiments of the disclosure.

FIG. 46D is an illustrative view of a portion of an “Anomalies Details”screen for a selected anomaly in the GUI of FIG. 39A, including an“Anomalous Activity Sequence” diagram, in accordance with variousembodiments of the disclosure.

FIG. 46E is an illustrative view of a portion of an “Anomalies Details”screen for a selected anomaly in the GUI of FIG. 39A, including an “UserActivities Baseline” diagram, “Compare Unusual Activity with theAccounts Profile” graphic, “Additional Information” graphic, and“Anomaly Graph” diagram, in accordance with various embodiments of thedisclosure.

FIG. 46F is an illustrative view of a portion of an “Anomalies Details”screen for an anomaly of the type “Machine Generated Beacon,” includinga “Users,” “Devices,” and “Domains” sections, and an “Anomaly Relations”box.

FIG. 47A is an illustrative view of a “Users Table” screen in the GUI ofFIG. 39A, in accordance with various embodiments of the disclosure.

FIG. 47B is an illustrative view of a “User Facts” screen in the GUI ofFIG. 39A, in accordance with various embodiments of the disclosure.

FIG. 47C is another illustrative view of a “User Facts” screen in theGUI of FIG. 39A, in accordance with various embodiments of thedisclosure.

FIG. 47D is an illustrative view of a “User Threats” screen in the GUIof FIG. 39A, in accordance with various embodiments of the disclosure.

FIG. 47E is an illustrative view of a “User Anomalies” screen in the GUIof FIG. 39A, in accordance with various embodiments of the disclosure.

FIG. 47F is an additional illustrative view of a “User Anomalies” screenin the GUI of FIG. 39A, in accordance with various embodiments of thedisclosure.

FIG. 47G is an illustrative view of a “Watchlist” screen in the GUI ofFIG. 39A, in accordance with various embodiments of the disclosure.

FIG. 48A is an illustrative view of a “Devices Table” screen in the GUIof FIG. 39A, in accordance with various embodiments of the disclosure.

FIG. 48B is an illustrative view of a “Device Facts” screen in the GUIof FIG. 39A, in accordance with various embodiments of the disclosure.

FIG. 48C is an illustrative view of a “Device Anomalies” screen in theGUI of FIG. 39A, in accordance with various embodiments of thedisclosure.

FIG. 49A is an illustrative view of an “Apps Table” screen in the GUI ofFIG. 39A, in accordance with various embodiments of the disclosure.

FIG. 49B is an illustrative view of an “App Facts” screen in the GUI ofFIG. 39A, in accordance with various embodiments of the disclosure.

FIG. 50A is an illustrative view of a Geomap icon in a Threats Tableview in the GUI of FIG. 39A, in accordance with various embodiments ofthe disclosure.

FIG. 50B is an illustrative view of a Geomap in the GUI of FIG. 39A, inaccordance with various embodiments of the disclosure.

FIG. 50C is an illustrative view of a text bubble for a threat in aGeomap in the GUI of FIG. 39A, in accordance with various embodiments ofthe disclosure.

FIG. 50D is an illustrative view of a text bubble for anomalies in aGeomap in the GUI of FIG. 39A, in accordance with various embodiments ofthe disclosure.

FIG. 51 is an illustrative view of an “Analytics Dashboard” in the GUIof FIG. 39A, in accordance with various embodiments of the disclosure.

FIG. 52 shows an example of a probabilistic suffix tree based modelreceiving a particular sequence (e.g., during training).

FIG. 53 shows an example timeline illustrating the training of aprobabilistic suffix tree based model, the establishment of a baselineprediction profile, and the activation of a particular model version.

FIG. 54A shows an example of how a normal behavioral sequence may berepresented in a probabilistic suffix tree based model.

FIG. 54B shows an example of how an unusual behavioral sequence may bediscovered in a probabilistic suffix tree based model.

FIG. 55A shows an example user interface for displaying discoveredanomalies.

FIG. 55B shows an example user interface displaying additionalinformation about the user.

FIG. 56 shows an example user interface displaying results fromcomparing the marginal of the events for the anomalous window and theentire data for the user (e.g., baseline).

FIG. 57 shows an example overview of all the unusual sequence as atimeline.

FIG. 58 shows an example user interface for an administrator to interactwith each timeline event.

FIG. 59 is a flowchart showing an example of an automated process forcluster identification from a graph.

FIG. 60A is a flowchart showing an example of an automated process forcluster identification from a bipartite graph.

FIG. 60B shows an example of minimizing the L1-norm values to findoptimal positions for the normal nodes.

FIG. 61A shows an example use case corresponding to the clusteridentification process for a generic graph, at a first stage ofprocessing.

FIG. 61B shows an example use case corresponding to the clusteridentification process for a generic graph, at a second stage ofprocessing.

FIG. 62 illustrates an example use case corresponding to the clusteridentification process for a bipartite graph.

FIG. 63 is a block diagram illustrating a machine learning model thatdetects lateral movement in a computer network.

FIG. 64 illustrates an example of a bipartite graph showing events ofusers logging into network devices.

FIG. 65 illustrates an example of a process of assigning similarityscores to network devices.

FIG. 66A shows an example of a bipartite graph having network devicesthat have many shared users and tend to have close similarity scores.

FIG. 66B shows an example of a bipartite graph having network devicesthat have multiple shared exclusive users.

FIG. 66C shows an example of a bipartite graph having network devicesthat have one shared user.

FIG. 66D shows an example of a bipartite graph having network devicesthat are associated with similar groups of users.

FIG. 67 illustrates an example of a graph data structure for detectingsecurity threats based on a detected out-of-profile anomaly.

FIG. 68 is a high-level conceptual diagram of an example network trafficscenario for detecting anomalies indicative of malware on a computernetwork.

FIG. 69 is a high level flow diagram illustrating an example process fordetecting an anomaly indicative of malware based on network traffic.

FIG. 70 shows two tables illustrating application of lexical analysis toa character-based entity identifier.

FIG. 71 shows an example incident response output configured for displayto a user.

FIG. 72 shows an example graph of outgoing traffic from a networkdevice.

FIG. 73 lists an example of a set of parameters that can be consideredfor distinguishing between machine-generated traffic and user-generatedtraffic.

FIG. 74 is a block diagram of an environment in which a system fordetecting anomalies in machine-generated traffic can be implemented.

FIG. 75 is an example of a memory cache storing beacon types that areidentified as likely to be anomalous.

FIG. 76 is a flow diagram of a process for determining whether outgoingtraffic from a device is anomalous.

FIG. 77 is a flow diagram of a process for forming a group of connectionrequests from outgoing traffic of a device.

FIG. 78 is a flow diagram of a process for determining whether aparticular group of connection requests in the outgoing traffic of adevice is user-generated traffic or machine generated traffic.

FIG. 79 is a flow diagram of a process for determining whethermachine-generated traffic is anomalous.

FIG. 80 is a block diagram of an environment in which a system fordetecting anomalies based on rarity scores of features can beimplemented.

FIG. 81 shows a table of example features and/or feature pairs to beconsidered for determining whether an example event is anomalous,consistent with various embodiments.

FIG. 82 shows a table listing example thresholds and/or parameters of ararity criterion for various example events that can be used fordetermining whether an event is anomalous.

FIG. 83 is a flow diagram of an example process for determining ananomaly based on a rarity score for a particular value of a feature.

FIG. 84 is a flow diagram of an example process for determining a rarityscore for a particular value of a feature.

FIG. 85 is a block diagram of a computing device that may be used toimplement the techniques introduced here.

DETAILED DESCRIPTION

References in this description to “an embodiment,” “one embodiment,” orthe like, mean that the particular feature, function, structure orcharacteristic being described is included in at least one embodiment ofthe present disclosure. Occurrences of such phrases in thisspecification do not necessarily all refer to the same embodiment. Onthe other hand, the embodiments referred to also are not necessarilymutually exclusive.

In the following description, the example of a security platform isused, for illustrative purposes only, to explain various techniques thatcan be implemented by the data processing system. Note, however, thatthe techniques introduced here are not limited in applicability tosecurity applications, security information and event management (SIEM)applications, or to any other particular kind of application. Forexample, at least some of the techniques introduced here can be used forautomated fraud detection and other purposes, based on machine data.Additionally, the techniques introduced here are not limited to use withsecurity-related anomaly and threat detection; rather, the techniquescan be employed with essentially any suitable behavioral analysis (e.g.,fraud detection or environmental monitoring) based on machine data. Ingeneral, “machine data” can include performance data, diagnosticinformation and/or any of various other types of data indicative ofperformance or operation of equipment (e.g., an action such as upload,delete, or log-in) in a computing system, as described further below. Ingeneral, “machine data” as used herein includes timestamped event data,as discussed further below. Examples of components that may generatemachine data from which events can be derived include: web servers,application servers, databases, firewalls, routers, operating systems,and software applications that execute on computer systems, mobiledevices, sensors, Internet of Things (IoT) devices, etc. The datagenerated by such data sources can include, for example, server logfiles, activity log files, configuration files, messages, network packetdata, performance measurements, sensor measurements, etc., which areindicative of performance or operation of a computing system in aninformation technology environment.

In today's enterprises, attacks by users with trusted access often goundetected by existing security approaches. Indeed, traditional securityproducts often suffer from several major drawbacks, including theinability to detect unknown threats and insider threats, and theinability to scale and process huge amount of data. Whether access isobtained by using compromised accounts/systems or by leveraging existingprivileges to conduct malicious activities, nowadays attackers often donot need to employ additional malware. The patterns of these maliciousactivities vary dynamically, and attackers can almost always find waysto evade traditional security technologies, such as rules-driven malwaredetection, malicious file signature comparison, and sandboxing. Also, asthe amount of the data increases, using human analysis to perform threatdetection becomes increasingly expensive and time prohibitive and suchhuman analysis does not allow the threat to be responded to in a timelyand effective manner. Further, security analysts such as networkadministrators often use a “kill chain” methodology to identify and stopthe progression of malicious activities (e.g., from intrusion to lateralmovement, and to exfiltration). These analysts need supporting evidenceto make educated decisions in the kill chain, but traditional securityproducts generally do not provide the support for such methodology.

Introduced here, therefore, is a data processing and analytics system(and, as a particular example, a security platform) that employs avariety of techniques and mechanisms for anomalous activity detection ina networked environment in ways that are more insightful and scalablethan the conventional techniques. As is described in more detail below,the security platform is “big data” driven and employs a number ofmachine learning mechanisms to perform security analytics. Morespecifically, the security platform introduced here can perform userbehavioral analytics (UBA), or more generally user/entity behavioralanalytics (UEBA), to detect the security related anomalies and threats,regardless of whether such anomalies and threats are previously known orunknown. Additionally, by presenting analytical results scored with riskratings and supporting evidence, the security platform can enablenetwork security administrators or analysts to respond to a detectedanomaly or threat, and to take action promptly. The behavioral analyticstechniques introduced here enable the security platform to detectadvanced, hidden and insider threats. As one aspect of this disclosure,the behavior analytics leverage machine learning data processingprocedures and do not require any preexisting knowledge such as knownsignatures or rules. The security platform can also improve threatdetection and targeted response by using a variety of threat indicators.Further, the security platform supplies supporting evidence withincontext of the kill chain to enable targeted remediation of any detectedanomaly or threat.

Moreover, as introduced here, the security platform can increase asecurity operations center's (SOC) efficiency with a number ofrank-ordered lists having events in the context of a kill chain. In someexamples, the kill chain can be linked from an anomaly or threat summaryto the supporting information that is gathered over time. All generatedsecurity-related information can then be sent to a security informationand event management (SIEM) application, such as the Splunk® App forEnterprise Security, to further scope, disrupt, contain and/or recoverfrom the attack.

FIG. 1 shows a general environment 10 in which the security platformintroduced here can be implemented. The environment 10 may represent anetworked computing environment of one or multiple companies ororganizations, and can be implemented across multiple geographicregions. One or more elements in the environment 10 are communicativelycoupled to each other through a computer communications network, whichcan include the Internet and one or more wired or wireless networks(e.g., an Internet Protocol (IP)-based local area network (LAN),metropolitan area network (MAN) wide area network (WAN), a Wireless LAN(WLAN) network such as Wireless Fidelity (WiFi), and/or a cellulartelecommunications network such as Global System for MobileCommunications (GSM) network, 3G network, or long term evolution (LTE)network). The computing devices shown in the environment 10 can be, forexample, a personal computer, a smart phone, a computer server, anotebook computer, or any other form of computing system or device thatallows a user to access the information within the environment 10. Eachof the aforementioned computer systems can include one or more distinctphysical computers and/or other processing devices which, in the case ofmultiple devices, can be connected to each other through one or morewired and/or wireless networks.

The security platform can detect anomalies and threats produced by auser, a device, or an application, for example, regardless of whetherthe entity that causes the anomalies or threats is from outside orinside the organization's network. The security analytics techniquesthat can be adopted by the security platform include behavioralanalytics that enable organizations of any size or skillset to detectand respond to unknown threats. Some specific examples that behavioralanalytics can be based on include machine learning, behavior modeling,peer group analysis, classification, statistical models, and graphanalysis. As introduced in more detail below, these analyses canutilize, for example, Markovian processing flows, inference and groupingprocesses, and risk scoring mechanisms to develop user and entityprofiles in order to compare and contrast activities, which ultimatelyallow the platform to detect and expose anomalies and threats. Also, asmentioned above, the security platform can include a graphical userinterface (GUI) that can create visualizations of the detected anomaliesand threats within an organization, and optionally, map the threatsacross an attack kill-chain in a visual way, which the security analystsin the organization can quickly and easily assimilate.

The security platform can be deployed at any of various locations in anetwork environment. In the case of a private network (e.g., a corporateintranet), at least part of the security platform can be implemented ata strategic location (e.g., a router or a gateway coupled to anadministrator's computer console) that can monitor and/or control thenetwork traffic within the private intranet. In the case of cloud-basedapplication where an organization may rely on Internet-based computerservers for data storage and data processing, at least part of thesecurity platform can be implemented at, for example, the cloud-basedservers. Additionally or alternatively, the security platform can beimplemented in a private network but nonetheless receive/monitor eventsthat occur on the cloud-based servers. In some embodiments, the securityplatform can monitor a hybrid of both intranet and cloud-based networktraffic. More details on ways to deploy the security platform and itsdetailed functionality are discussed below.

By addressing the entire lifecycle of known and unknown advancedsecurity threats, and by providing a platform to detect, respond to, andautomate actions, the security platform introduced here provides acomprehensive solution to the security-related issues in a modernnetwork environment.

I. Security Platform System Overview

The security platform introduced here is capable of handling largevolumes of data, particularly machine data, from multiple data sources.These data sources may have different data formats and may provide dataat very high data rates (e.g., gigabytes of data per second or more). Insome embodiments, incoming data is processed using machine learning/datascience techniques to extract knowledge from large volumes of data thatare structured or unstructured. In a general sense, data science is acontinuation and expansion of the field of data mining and predictiveanalytics, also known as knowledge discovery and data mining (KDD).

The security platform may be cloud-based and may employ big datatechniques to process a vast quantity of high data rate information in ahighly scalable manner. In certain embodiments, the security platformmay be hosted in the cloud and provided as a service. In certainembodiments, the security platform is provided as aplatform-as-a-service (PaaS). PaaS is a category of cloud computingservices enabling customers to develop, run and manage Web applicationswithout the complexity of building and maintaining the infrastructuretypically associated with developing and launching such applications.PaaS can be delivered in at least two ways, namely: (i) as a publiccloud service from a provider, wherein the consumer controls softwaredeployment and configuration settings and the provider provides thenetworks, servers, storage devices and other services to host theconsumer's application, or (ii) as software installed in private datacenters or public infrastructure and managed by internal informationtechnology (IT) departments.

Machine learning is employed in certain embodiments to make itunnecessary to know in advance what activity constitutes a securitythreat or a security threat signature. For example, a security threatmay be discovered from the event data as the events occur even thoughthat threat has not been seen before and no signature for that threatexisted previously.

In various embodiments discussed herein, security threats are examplesof a type of activity to be detected. It should be understood, however,that the security platform and techniques introduced here can be appliedto detect any type of unusual or anomalous activity involving dataaccess, data transfer, network access, and network use regardless ofwhether security is implicated or not.

In this description the term “event data” refers to machine data relatedto activity on a network with respect to an entity of focus, such as oneor more users, one or more network nodes, one or more network segments,one or more applications, etc.). In certain embodiments, incoming eventdata from various data sources is evaluated in two separate data paths:(i) a real-time processing path and (ii) a batch processing path.Preferably, the evaluation of event data in these two data paths occursconcurrently. The real-time processing path is configured tocontinuously monitor and analyze the incoming event data (e.g., in theform of an unbounded data stream) to uncover anomalies and threats. Tooperate in real-time, the evaluation is performed primarily orexclusively on event data pertaining to current events contemporaneouslywith the data being generated by and/or received from the datasource(s). In certain embodiments, the real-time processing pathexcludes historical data (i.e., stored data pertaining to past events)from its evaluation. Alternatively in an embodiment, the real-timeprocessing path excludes third-party data from the evaluation in thereal-time processing path. These example types of data that are excludedfrom the real-time path can be evaluated in the batch processing path.

In this description the term “event” is sometimes used synonymously withthe term “event data” to mean a discrete set of machine data thatrepresents or corresponds to a specific network activity, although“event” can also refer to the underlying activity itself, as will beapparent from context.

Also in this description, an “anomaly” is a detected variation from anexpected pattern of behavior on the part of an entity, which variationmay or may not constitute a threat. An anomaly represents an event ofpossible concern, which may be actionable or warrant furtherinvestigation. An anomaly is an observable or detectable fact, or datarepresenting such fact. An anomaly or a set of anomalies may beevaluated together and may result in a determination of a threatindicator or a threat. A threat is an interpretation of one or moreanomalies and/or threat indicators. Threat indicators and threats areescalations of events of concern. As an example of scale, hundreds ofmillions of packets of incoming event data from various data sources maybe analyzed to yield 100 anomalies, which may be further analyzed toyield 10 threat indicators, which may again be further analyzed to yieldone or two threats. This manner of data scaling is one of the reasonsthe security platform can provide anomaly and threat detection in areal-time manner.

In the context of machine-learning evaluation, historical data and thirdparty data may be used to create and improve the machine learning modelsemployed to perform the evaluation; however, the amount of suchhistorical data and/or third party data can be potentially much largerthan the real-time data stream. As such, the actual evaluation of thehistorical data tends to be slower. Consequently, in certainembodiments, the real-time processing path does not use either or boththe historical data and third party data as inputs. In otherembodiments, historical and third party data may be used as inputs butthe majority of the data used for evaluation in the real-time processingpath still pertains to contemporaneous incoming event data. This is aconsequence of the need to process the voluminous incoming event dataquickly to obtain actionable threat information to prevent imminentharm.

The anomalies and threats detected by the real-time processing path maybe employed to automatically trigger an action, such as stopping theintrusion, shutting down network access, locking out users, preventinginformation theft or information transfer, shutting down software and orhardware processes, and the like. In certain embodiments, the discoveredanomalies and threats may be presented to a network operator (e.g., anetwork security administrator or analyst) for decision. As analternative or in addition to automatically taking action based on thediscovered anomalies and threats, the decisions by the user (e.g., thatthe anomalies and threats are correctly diagnosed, or that thediscovered anomalies and threats are false positives) can then beprovided as feedback data in order to update and improve the models.

In the batch processing path, historical data and third-party data areprocessed, optionally with the incoming real-time event data, touncover, for example, more subtle anomalies and threats than thereal-time processing path can uncover because of the real-timeprocessing path's responsive time constraints. Batch processing mayoccur synchronously with real-time processing or in accordance with apredefined schedule.

Historical data represents past events and may include data fromdifferent instantiations of the real-time evaluators deployed indifferent locations in the network. The historical data may span timeand geography. In some implementations, only an abridged version of theincoming event data is analyzed in the real-time processing path while amore complete version is stored as historical data. Thus, the historicaldata may, in one or more of these implementations, include event datathat has more attributes than the abridged event data presented to thereal-time processing path for evaluation.

As in the real-time data path, anomalies, threat indicators and threatsdiscovered by the batch analyzer may be actionable automatically or maybe presented to a human operator for decision on whether to take action.The action taken by the operator to validate or invalidate theconclusions reached by the batch analyzer may serve as a source offeedback to the security platform to improve its evaluation ofsubsequently processed data.

FIG. 2 illustrates a high level view of an example security platform102. In FIG. 2, a cloud computing infrastructure is shown, representedin part by a virtualization layer 104. Various cloud computing operatingsystems or platforms, such as OpenStack™, VMware™, Amazon Web Services™,or Google Cloud™ may be employed in virtualization layer 104 to createpublic clouds or private clouds. Generally speaking, these cloudcomputing operating systems and others permit processing and storage tobe implemented on top of a set of shared resources. Among its manyadvantages, cloud computing permits or facilitates redundancy, faulttolerance, easy scalability, low implementation cost and freedom fromgeographic restrictions. The concept of cloud computing and the variouscloud computing operating systems or infrastructures are known.

Above the virtualization layer 104, a software framework layer 106implements the software services executing on the virtualization layer104. Examples of such software services include open-source softwaresuch as Apache Hadoop™, Apache Spark™, and Apache Storm™. Apache Hadoop™is an open-source software framework for distributed storage anddistributed processing of very large data sets on computer clustersbuilt from commodity hardware. Apache Storm™ is a distributed real-timecomputation engine that processes data stream record-by-record. ApacheSpark™ is an large-scale data processing engine that collects eventstogether for processing in batches. These are only examples of softwarethat may be employed to implement the software framework layer 106.

A security intelligence layer 100 implements a security semantic layer108 and a machine learning layer 110. The security semantic layer 108performs the extract, transform, and load (ETL) functions that preparethe incoming event data for further processing by downstream consumers.Note that the term ETL here is used in an illustrative sense tofacilitate understanding, as the ETL stage described herein may includefunctionality in addition to or different from traditional ETLtechniques. The machine learning layer 110 represents one of theconsumers of the data output of the security semantic layer 108. In anexample, event data may be received by the security semantic layer 108,and prepared (or “pre-processed”) to be further processed by the machinelearning layer 110.

Above the security intelligence layer 100 is an application layer 114.The application layer 114 represents the layer in which applicationsoftware modules may be implemented. In an example, the output of themachine learning layer 110 includes anomalies, threat indicators, and/orthreats. This output may be analyzed by the various applications such asa threat detection application 116, a security analytics application 118or other applications 120. These layers, modules and their operationwill be discussed in greater detail below.

FIG. 3 shows a high-level conceptual view of the processing withinsecurity platform 102 in FIG. 2. A receive data block 202 represents alogical component in which event data and other data are received fromone or more data sources. In an example, receive data block 202 includesapplication programming interfaces (APIs) for communicating with variousdata sources. An ETL block 204 is the data preparation component inwhich data received from the receive data block 202 is pre-processed,for example, by adding data and/or metadata to the event data (a processinterchangeably called decoration, enrichment or annotation herein), orotherwise prepared, to allow more effective consumption by downstreamdata consumers (e.g., machine learning models).

The enriched event data from the ETL block 204 is then provided to areal-time analyzer 210 over a real-time processing path 212 fordetecting anomalies, threat indicators and threats. Output 214 from thereal-time analyzer 210 is provided for action by the human operator, incertain embodiments. It should be noted that the real-time analyzer 210operates in real-time by analyzing event data as the event data receivedby the security platform 102.

The event data from the ETL block 204 is also provided to a batchanalyzer 240 over a batch processing path 242 for detecting anomalies,threat indicators and threats. However, while the event data is providedto the real-time analyzer 210 in an unbounded, streaming,record-by-record manner, it is provided to the batch analyzer in theform of batches of event data (i.e., where each batch of event datacontains a collection of events that arrived over the batch period).Because the batch analyzer 240 processes data in batch mode instead ofin real-time, in addition to the event data that the real-time analyzer210 receives, the batch analyzer 240 can receive additional historicalevent data from the security platforms, prior analysis (including theanalysis results, the model states, and the supporting data) from thereal-time analyzer 210 (e.g., through a model management component 260),or prior analysis from other analyzers (real-time or batch) implementedelsewhere in the same or other networks.

A machine learning and machine learning models are employed to evaluateand analyze data in certain embodiments, that is not necessarily thecase in every embodiment. In some cases, the security platform may alsoadapt more appropriately or more efficiently to the environment by usinga combination of other suitable forms of analysis, including rule-basedanalysis, algorithm-based analysis, statistical analysis, etc.

FIG. 4 illustrates an example of an overall architecture of the securityplatform 300. Data sources 302 represent various data sources thatprovide event data including machine data, to be analyzed for anomaliesand threats. The event data represents events that take place in thenetwork environment. For example, data source 304 is a source of datapertaining to logs including, for example, user log-ins and other accessevents. These records may be generated from operational (e.g., networkrouters) and security systems (e.g., firewalls or security softwareproducts). Data source 306 is a source of data from different types ofapplications, including software as a service (e.g., Box™). Data source306 may use different mechanisms for transmitting the event data,including a push mechanism, a pull mechanism, or a hybrid mechanism.Other data sources which may fall into the data source 306 categoryinclude human resource systems, accounting systems, customer relationdatabases, and the like. Data source 308 is a source of networkmanagement or analyzer data (e.g., event data related to traffic on anode, a link, a set of nodes, or a set of links). The network managementor analyzer data may be obtained from various network operating systemsand protocols, such as Cisco Netflow™. The data sources mentioned hereare only examples, as other suitable data sources may also be used.

The data sources 302 provide event data to data receivers 310, whichimplement various APIs and connectors to receive (or retrieve, dependingon the mechanism) the event data for the security platform 300. The datareceivers 310 may also optionally filter some of the event data. Forexample, to reduce the workload of the security platform, a businessrule may be set to state that all query events to “www.google.com”should be filtered out as not interesting (e.g., this type of access isdetermined not to represent any security threat). Technologies employedto implement the data receiver 310 may include Flume™ and REST™. Flume™is an open-source distributed service for collecting, aggregating, andmoving large amounts of log data. REST™ is an interface for accessinglarge databases.

The received data is then provided via a channel 314 to a semanticprocessor (or data preparation stage) 316, which in certain embodimentsperforms, among other functions, ETL functions. In particular, thesemantic processor 316 may perform parsing of the incoming event data,enrichment (also called decoration or annotation) of the event data withcertain information, and optionally, filtering the event data. Thesemantic processor 316 introduced here is particularly useful when datareceived from the various data sources through data receiver 310 is indifferent formats, in which case the semantic processor 316 can preparethe data for more efficient downstream utilization (including, forexample, by an event processing engine) while avoiding binding theunstructured data into any particular type of data structure.

A parser in the semantic processor 316 may parse the various fields ofreceived event data representing an event (e.g., a record related to alog-in event). An identity resolution (IR) component (not shown in FIG.4) may be optionally provided within the semantic processor 316 tocorrelate IP addresses with users, for example. This correlation permitsthe security platform to make certain assumptions about the relationshipbetween an IP address and a user so that, if any event data arrives fromthat IP address in the future, an assumption regarding which user isassociated with that IP address may be made. In some implementations,the event data pertaining to that IP address may be annotated with theidentity of the user. Technology used to implement the data preparationfunctions of the semantic processor 316 may include Redis™.

An optional filter attribution block 322 in the semantic processor 316removes certain pre-defined events. The attribution filter 322 in thesemantic processor 316 may further remove events that need not beprocessed by the security platform. An example of such an event is aninternal data transfer that occurs between two IP addresses as part of aregular file backup. In some embodiments, the functions of semanticprocessor 316 are configurable by a configuration file to permit easyupdating or adjusting. Examples of configurable properties of thesemantic processor 316 include how to (i) parse events, (ii) correlatebetween users and IP address, and/or (iii) correlate between oneattribute with another attribute in the event data or an externalattribute. The configuration file can also adjust filter parameters andother parameters in the semantic processor 316.

Data processed by the semantic processor 316 is sent to a distributionblock 320. The distribution block 320 can be a messaging mechanism todistribute data to one or both of the real-time processing path and thebatch processing path. The real-time processing path is entered via theright-facing arrow extending from the distribution block 320, whereasthe batch processing path is entered via arrow 388 extending downwardfrom the distribution block 320.

The real-time processing path includes an analysis module 330 thatreceives data from the distribution block 320. The analysis module 330analyzes the data in real-time to detect anomalies, threat indicators,and threats. In certain embodiments, the aforementioned Storm™ platformmay be employed to implement the analysis module 330. In otherembodiments, the analysis module could be implemented by using ApacheSpark Streaming.

In FIG. 4, at least two topologies 332 and 334 are illustrated inanalysis module 330. Generally, a topology in this context is aspecification of how an analysis module (e.g., module 330) groups anddistributes work (e.g., to the different computation workers). Atopology can also specify how the analysis module 330 groups anddistributes input data for the model-related process threads. Moredetails on the analysis module 330 and topologies are discussed below inrelevant sections. Different machine learning models may evaluatedifferent aspects of the pre-processed event data received from thedistribution block 320. The machine learning models can also generatesecurity-related scores for the events. The results from the analysismodule 330 may be, for example, anomalies, threat indicators, andthreats.

These anomalies, threat indicators and threats may be provided to a userinterface (UI) system 350 for review by a human operator 352. As anexample, a visualization map and a threat alert may be presented to thehuman operator 352 for review and possible action. The output of theanalysis module 330 may also automatically trigger actions such asterminating access by a user, terminating file transfer, or any otheraction that may neutralize the detected threats. In certain embodiments,only notification is provided from the analysis module 330 to the UIsystem 350 for review by the human operator 352. The event data thatunderlies those notifications or that gives rise to the detection madeby the analysis module 330 are persistently stored in a database 378. Ifthe human operator decides to investigate a particular notification, heor she may access from database 378 the event data (including raw eventdata and any associated information) that supports the anomalies orthreat detection. On the other hand, if the threat detection is a falsepositive, the human operator 352 may so indicate upon being presentedwith the anomaly or the threat. The rejection of the analysis result mayalso be provided to the database 378. The operator feedback information(e.g., whether an alarm is accurate or false) may be employed to updatethe model to improve future evaluation.

Arrow 360 represents the storing of data supporting the analysis of theanomalies and threats in the real-time path. For example, the anomaliesand threats as well as the event data that gives rise to detection ofthe anomalies and threats may be stored in database 378 (e.g., an SQLstore) using a path represented by the arrow 360. Additional informationsuch as the version of the models, the identification of the modelsused, and the time that the detection is made, may also be stored.

The human operator 352 may review additional information in response tothe notification presented by the UI system 350. The data supporting theanalysis of the anomalies and threats may be retrieved from database 378via an access layer 364. Arrow 362 represents a data retrieval requestvia the access layer 364 to one or more of databases 370, 372, 374 and378. The data served up by the databases would be provided to the UI 350by means of data pathway 380. The access layer 364 includes the APIs foraccessing the various databases and the user interfaces in the UI 350.For example, block 366A represents the API for accessing the HBase orHDFS (Hadoop File Service) databases. Block 366B represents the variousAPIs compatible for accessing servers implementing sockets.io or node jsservers. SQL API 366C represents the API for accessing the SQL datastore 378, which stores data pertaining to the detected threats andanomalies.

Line 368 is a conceptual line that separates the batch processing path(below line 368) from the real-time processing path (above line 368).The infrastructure which may operate in batch mode includes the SQLstore 378 that stores information accessible by scripted query language(SQL), a time series database 370 that represents the database forstoring time stamped data, an HBase 372 that can be an open-source,distributed, non-relational database system on which databases (e.g.,the time serious database 370) can be implemented, and a GraphDBdatabase 374 that stores security graphs 392, which may be based onrelationship graphs generated from events. In some embodiments, theGraphDB database 374 comprises a Neo4j™ graph database.

A security graph, as described further below, is generally arepresentation of the relationships between entities in the network andany anomalies identified. For example, a security graph may map out theinteractions between users, including information regarding whichdevices are involved, who or what is talking to whom/what, when and howinteractions occur, which nodes or entities may be anomalous, and thelike. The nodes of the security graph may be annotated with additionaldata if desired.

A batch analysis module 382 is the analysis module that processes datain batches. The analysis module 382 may take into account the historicalevent data stored in databases 370, 372, 374, and 378 (including“relatively” contemporary event data that is passed from distributionblock 320 to the persistent layer below line 368 via network channel388). In one example, the batch analysis module 382 may employ thirdparty data 384. With more time allowance and more data available foranalysis, the batch analysis module 382 may be able to uncoveradditional anomalies and threats that may not be easily detectable bythe real-time analysis module 330. The model management block 386includes a model store and a model registry. The model registry canstore model type definitions for machine learning models, and the modelstore can store model states for machine learning models. Additionaldetails on the model registry and the model store are discussed below.

In certain embodiments, the models that are employed for evaluation byone analysis module may be shared with another module. Model statesharing 390 may improve threat detection by various modules (e.g., twomodules belonging to an international network of the same company, butone deployed in Asia and another one deployed in North America; or, onemodule being used in the real-time path and another in the batch path)as the model state sharing leverages knowledge learned from one moduleto benefit others. Security graphs 392 may also be shared among modules,and even across different organizations. For example, activities thatgive rise to a detection of anomalies or a threat in one enterprise maythus be shared with other enterprises. Hadoop nodes 394 represent theuse of cloud-based big data techniques for implementing the architectureof FIG. 4 to improve scalability as well as the ability to handle alarge volume of data. Control path 396 represents the control softwarethat may be used for monitoring and maintaining the security platform300.

FIG. 5 shows an example implementation of the real-time processing pathin greater detail. With reference to both FIGS. 4 and 5, the analysismodule 330 has been expanded as two analysis modules 330A and 330B torepresent the anomaly detection stage and the threat detection stage,respectively. The analysis module 330A is responsible for detectinganomalies, and the output of the analysis module 330A is provided to theanalysis module 330B for detecting threats based on the detectedanomalies. In practice, the two stages may be performed by the samemodule utilizing different models in a staged manner.

The output of analysis module 330A, representing the anomalies, isprovided to an anomaly writer 402. The anomaly writer 402 can store theanomalies (e.g., including event data representing an anomalous eventand any associated information) in the database 378. The same anomaliesmay also be stored in the time series database 370 and the HBase 372.The anomalies may also be stored in the graph database 374. In someembodiments, the anomalies can be stored in graph database 374 in theform of anomaly nodes in a graph or graphs; specifically, after an eventis determined to be anomalous, an event-specific relationship graphassociated with that event can be updated (e.g., by the anomaly writer402) to include an additional node that represents the anomaly, asdiscussed further below. Certain embodiments of the security platformprovide the ability to aggregate, at a specified frequency (e.g., once aday), the individual event-specific relationship graphs from all theprocessed events in order to compose a composite relationship graph fora given enterprise or associated network. This aforementioned update toan individual event's relationship graph allows the compositerelationship graph to include nodes representing anomalies, therebyproviding more security-related information. The individualevent-specific relationship graph and the composite relationship graphare discussed in more detail below. The information stored may includethe anomalies themselves and also relevant information that exists atthe time of evaluation. These databases allow rapid reconstruction ofthe anomalies and all of their supporting data.

The output from the analysis modules 330B, representing threats, may bestored in the database 378, the times series database 370 or the Hbase372. As in the case of anomalies, not only are the threats themselvesstored, but relevant information that exists at the time of evaluationcan also be stored.

The batch analysis module 382 can also operate in two stages for anomalyand threat detection in a similar fashion as discussed above withrespect to the real-time analysis module 330.

II. User Behavior Analysis (UBA)/User-Entity Behavior Analysis (UEBA)

The security platform 300 can detect anomalies and threats bydetermining behavior baselines of various entities that are part of, orthat interact with, a network, such as users and devices, and thencomparing activities of those entities to their behavior baselines todetermine whether the activities are anomalous, or even rise to thelevel of threat. The behavior baselines can be adaptively varied by theplatform 300 as new data are received. These functions can be performedby one or more machine-learning models, for example, in the real-timepath, the batch path, or both.

FIG. 6 shows an example representation of a process of building behaviorbaselines to support the detection of anomalies. A human end user 602may employ a server 606 to access a source code server 610 for his work,for example. Assume that the human user 602 occasionally accesses thedata stored in servers 608. In a manner described in more detail below,the security platform 300 can generate a baseline profile 612 for accessactivities of user 602, based on event data indicative of networkactivities of user 602. Likewise, a human administrative user 604 otherthan user 602 may employ the server 606 to access the data stored in theservers 608. A baseline profile 614 specific for access activities ofuser 604 can also be generated over time by the security platform 300,based on event data indicative of network activities of user 604.

The security platform 300 can create a behavior baseline for any type ofentity (for example, a user, a group of users, a device, a group ofdevices, an application, and/or a group of applications). In the exampleof FIG. 6, the activities of server 606 are monitored and a baselineprofile 616 specific for the server 606 is generated over time, based onevent data indicative of network activities of server 606.

Baseline profiles can be continuously updated (whether in real-time asevent data streams in, or in batch according to a predefined schedule)in response to received event data, i.e., they can be updateddynamically and/or adaptively based on event data. If the human user 604begins to access source code server 610 more frequently in support ofhis work, for example, and his accessing of source code server 610 hasbeen judged to be legitimate by the security platform 300 or a networksecurity administrator (i.e., the anomalies/threats detected uponbehavior change have been resolved and deemed to be legitimateactivities), his baseline profile 614 is updated to reflect the updated“normal” behavior for the human user 604.

In certain embodiments, anomalies and threats are detected by comparingincoming event data (e.g., a series of events) against the baselineprofile for an entity to which the event data relates (e.g., a user, anapplication, a network node or group of nodes, a software system, datafiles, etc.). If the variation is more than insignificant, the thresholdfor which may be dynamically or statically defined, an anomaly may beconsidered to be detected. The comparison may be based on any of varioustechniques, for example, time-series analysis (e.g., number of log-insper hour), machine learning, or graphical analysis (e.g., in the case ofsecurity graphs or security graph projections). Preferably, thisdetection is performed by various machine learning models.

Additional details are discussed below regarding various components ofthe security platform including, for example, the data intake andpreparation engine, event processing engine, configurations forreal-time implementations, configurations for batch implementation,machine learning models and different applications, various kinds ofanomaly and threat detections, and graphic user interfaces forpresenting security-related issues.

III. Data Intake and Preparation

FIGS. 7A and 7B collectively show a table 700 listing example types ofmachine data that can be generated in different environments and themeaning of these data. During operation, various components within acomputing environment often generate significant volumes ofmachine-generated data (i.e., “machine data”). In general, machine datacan include performance data, diagnostic information and/or any ofvarious other types of data indicative of performance or operation ofequipment (e.g., an action such as upload, delete, or log-in) in acomputing system. Such data can be analyzed to diagnose equipmentperformance problems, monitor user actions and interactions, and toderive other insights like user behavior baseline, anomalies andthreats.

As shown in the table 700, machine data may contain a record (e.g., alog) of an event that takes place in the network environment, such as anactivity of a customer, a user, an transaction, an application, aserver, a network or a mobile device. However, in many instances,machine data can be more than mere logs—it can include configurations,data from APIs, message queues, change events, the output of diagnosticcommands, call detail records, sensor data from industrial systems, andso forth.

As used herein, “an event” may refer to the actual event or activitythat takes place in the network, or for the simplicity of thediscussion, it may refer to the machine data (or “event data”) thatrecords, corresponds to, or otherwise represents the event. The term'smeaning is made apparent by the context of the discussion and the twomeanings of the term may be used in an interchangeable manner in somescenarios. For example, “extracting a token from an event” will beunderstood as extracting a token from the event data that represents theevent. Also, note that the data intake and preparation stage describedherein may be as alternatively called the extract-transform-load (ETL)stage; however, the data intake and preparation stage disclosed here isnot limited to traditional ETL techniques. In some implementations, thedata intake and preparation stage includes an ETL engine/pipeline, butalso includes/performs other functions beyond or different from atraditional ETL stage, as henceforth described herein. Consequently, theterm “data pre-processing” is used interchangeably with “datapreparation,” and is intended to include any combination of dataextraction, transformation, annotation/supplementation, and/or otheradditional techniques introduced here. The term “stage,” as in the dataintake and preparation stage, may also be referred to as “engine.”

Events occurring in a computer network may belong to different eventcategories (e.g., a firewall event, a threat information, a login event)and may be generated by different machines (e.g., a Cisco™ router, aHadoop™ Distributed File System (HDFS) server, or a cloud-based serversuch as Amazon Web Services™ (AWS) CloudTrail™). Therefore, machine datacan come in many different formats, at least some of which may not bepredictable. Traditional monitoring and analysis tools are not designedfor the variety, velocity, volume or variability of such a dataenvironment. Furthermore, different kinds of event data types cancontain different information. Generally, the higher the communicationlayer (in terms of the well-known open system interconnection (OSI)model) to which an event belongs, the richer the information that eventcontains. For example, a network packet log may only include informationon which machine communicates with which other machine(s); in contrast,an application log may have the richest information, thereby having ahigher value. Particularly, in an application log, not only is itpossible to obtain information on which machine is communicating withwhich other machine(s), but it is also possible to ascertain what kindof information these machines are sharing. For another example, sessionlayer data may be used to identify (e.g., via techniques disclosed here)which user is attempting to log in with what credential and using whichparticular session, and therefore would be more valuable thanlower-level network layer data. However, a typical computer network hassignificantly more lower-level layer data than higher-level layer data.Therefore, as the variety, velocity, and volume of the data in theenvironment greatly increase, traditional monitoring and analysissystems either simply ignore a large portion of the data, or theyquickly become overloaded by the data, thereby losing accuracy andresponsiveness.

Accordingly, the security platform introduced here includes variousaspects that are specifically tailored to this data environment,including techniques for obtaining different kinds of data, preparingdata, and processing data, by using different stages, to enable quickdiagnosis of service problems, detection of sophisticated securitythreats, understanding of the health and performance of remoteequipment, and demonstration of compliance.

FIG. 8 shows an example implementation of a data intake and preparationstage 800 of the security platform. The data intake and preparationstage (or engine) 800 can be an implementation of ETL stage 204 in FIG.3 and/or semantic processor 316 in FIG. 5. The data intake andpreparation stage 800 can include a number of components that perform avariety of functions disclosed herein. In the example of stage 800, thedata intake and preparation stage of the security platform includes anumber of data connectors 802, a format detector 804, a number ofparsers 806, a field mapper 808, a relationship graph generator 810, anidentity resolution module 812, a number of decorators 814, and eventview adder 816. These components (e.g., sets of instructions) need notbe implemented as separate software programs, procedures or modules, andthus various subsets of these components may be combined or otherwiserearranged in various embodiments. Also, the components shown in FIG. 8are only one example of the data intake and preparation stage componentsthat can be used by the security platform; the data intake andpreparation stage could have more or fewer components than shown, or adifferent configuration of components.

The various components shown in FIG. 8 can be implemented by usinghardware, software, firmware or a combination thereof, including one ormore signal processing and/or application specific integrated circuits.The components in the stage 800 are shown arranged in a way thatfacilitates the discussion herein; therefore, any perceivable sequencein the stage 800 is merely an example and can be rearranged. Any step inthe stage 800 may be performed out-of-sequence and/or in parallel to theextent that such rearrangement does not violate the logic dependency ofthe steps. One or more steps described for the stage 800 may beoptional, depending on the deployed environment. The data output fromthe data intake and preparation stage 800 can also be referred to hereinas “decorated events” or “event feature sets.” A decorated eventincludes the raw machine data associated with an event, plus anydecoration, enrichment, information, or any other suitable intelligencethat is generated based upon or extracted from the event during the dataintake and preparation stage. In some embodiments, because of thecomputationally intensive processes that the data intake and preparationstage may perform, the data intake and preparation engine may beimplemented separately from the rest of the stages in the securityplatform, for example, on a standalone server or on dedicated nodes in adistributed computer cluster.

Various data connectors 802 can be employed by the security platform(e.g., at the data intake stage) to support various data sources.Embodiments of the data connectors 802 can provide support foraccessing/receiving indexed data, unindexed data (e.g., data directlyfrom a machine at which an event occurs), data from a third-partyprovider (e.g., threat feeds such as Norse™, or messages from AWS™CloudTrail™), or data from a distributed file system (e.g., HDFS™).Hence, the data connectors 802 enable the security platform to obtainmachine data from various different data sources. Some examplecategories of such data sources include:

(1) Identity/Authentication: e.g., active directory/domain controller,single sign-on (SSO), human resource management system (HRMS), virtualprivate network (VPN), domain name system (DNS), or dynamic hostconfiguration protocol (DHCP);

(2) Activity: e.g., web gateway, proxy server, firewall, Netflow™, dataloss prevention (DLP) server, file server, or file host activity logs;

(3) Security Products: e.g., endpoint security, intrusion preventionsystem, intrusion detection system, or antivirus;

(4) Software as a Service (SaaS) or Mobile: e.g., AWS™ CloudTrail™, SaaSapplications such as Box™ or Dropbox™, or directly from mobile devices;and

(5) External Threat Feeds: e.g., Norce™, TreatStream™, FinancialServices Information Sharing and Analysis Center (FS-ISAC)™, orthird-party blacklisted IP/domains.

Depending on the embodiment, external threat feeds may directly feed tothe security platform, or indirectly through one or more securityproducts that may be coexisting in the environment within which thesecurity platform is deployed. As used herein, the term “heterogeneousevent” refers to the notion that incoming events may have differentcharacteristics, such as different data formats, different levels ofinformation, and so forth. Heterogeneous events can be a result of theevents originating from different machines, different types of machines(e.g., a firewall versus a DHCP server), being in a different dataformat, or a combination thereof.

The data connectors 802 can implement various techniques to obtainmachine data from the data sources. Depending on the data source, thedata connectors 802 can adopt a pull mechanism, a push mechanism, or ahybrid mechanism. For those data sources (e.g., a query-based system,such as Splunk®) that use a pull mechanism, the data connectors 802actively collect the data by issuing suitable instructions to the datasources to grab data from those data sources into the security platform.For those data sources (e.g., ArcSignt™) that use a push mechanism, thedata connectors 802 can identify an input (e.g., a port) for the datasources to push the data into the system. The data connectors 802 canalso interact with a data source (e.g., Box™) that adopts a hybridmechanism. In one embodiment of the data connectors 802 for such hybridmechanism, the data connectors 802 can receive from the data source anotification of a new event, acknowledges the notification, and at asuitable time communicate with the data source to receive the event.

For those data connectors 802 that may issue queries, the queries can bespecifically tailored for real-time (e.g., in terms of seconds or less)performance. For example, some queries limit the amount of theanticipated data by limiting the query to a certain type of data, suchas authentication data or firewall related data, which tends to be morerelevant to security-related issues. Additionally or alternatively, somequeries may place a time constraint on the time at which an event takesplace.

Moreover, in some examples, the data connectors 802 can obtain data froma distributed file system such as HDFS™. Because such a system mayinclude a large amount of data (e.g., terabytes of data or more), it ispreferable to reduce data movement so as to conserve network resources.Therefore, some embodiments of the data connectors 802 can generate anumber of data processing jobs, send the jobs to a job processingcluster that is coupled to the distributed file system, and receive theresults from the job processing cluster. For example, the dataconnectors 802 can generate MapReduce™ jobs, and issue those jobs to ajob processing cluster (e.g., YARN™) that is coupled to the distributedfile system. The output of the job processing cluster is received backinto the security platform for further analysis, but in that case, no orvery little raw machine data is moved across the network. The data isleft in the distributed file system. In some examples, the generatedjobs are user behavior analysis related.

Optionally, after the data connectors 802 obtain/receive the data, ifthe data format of the data is unknown (e.g., the administrator has notspecified how to parse the data), then the format detector 804 can beused to detect the data format of the input data. For example, theformat detector 804 can perform pattern matching for all known formatsto determine the most likely format of a particular event data. In someinstances, the format detector 804 can embed regular expression rulesand/or statistical rules in performing the format detection. Someexamples of the format detector 804 employ a number of heuristics thatcan use a hierarchical way to perform pattern matching on complex dataformat, such as an event that may have been generated and/or processedby multiple intermediate machines. In one example, the format detector804 is configured to recursively perform data format pattern matching bystripping away a format that has been identified (e.g., by strippingaway a known event header, like a Syslog header) in order to detect aformat within a format.

However, using the format detector 804 to determine what data format theinput data may be at run time may be a time- and resource-consumingprocess. At least in the cybersecurity space, it is typical that theformats of the machine data are known in advance (e.g., an administratorwould know what kind of firewall is deployed in the environment).Therefore, as long as the data source and the data format are specified,the data intake and preparation stage can map the data according toknown data formats of a particular event source, without the need ofperforming data format detection. In certain embodiments, the securityplatform can prompt (e.g., through a user interface) the administratorto specify the data format or the type of machine(s) the environmentincludes, and can automatically configure, for example, the parsers 806in the data intake and preparation stage for such machines.

Further, the security platform provides a way to easily supporting newdata format. Some embodiments provide that the administrator can createa new configuration file (e.g., a configuration “snippet”) to customizethe data intake and preparation stage for the environment. For example,for a particular data source, the configuration file can identify, inthe received data representing an event, which field represents a tokenthat may correspond to a timestamp, an entity, an action, an IP address,an event identifier (ID), a process ID, a type of the event, a type ofmachine that generates the event, and so forth. In other examples (e.g.,if a new data format is binary), then the security platform allows anadministrator to leverage an existing tokenizer/parser by changing theconfiguration file, or to choose to implement a new, customized parseror tokenizer.

In a number of implementations, through the configuration file (e.g.,snippet), the administrator can also identify, for example, fieldmappings, decorators, parameters for identity resolution (IR), and/orother parameters of the data intake and preparation stage. Theconfiguration snippet can be monitored and executed by the data intakeand preparation engine on the fly to allow the an administrator tochange how various components in the data intake and preparation enginefunctions without the need to recompile codes and/or restart thesecurity platform.

After receiving the event data by the data connectors 802, the parsers806 parse the event data according to a predetermined data format. Thedata format can be specified in, for example, the configuration file.The data format can be used for several functions. The data format canenable the parser to tokenize the event data into tokens, which may bekeys, values, or more commonly, key-value pairs. Examples of supporteddata format include event data output from an active-directory event, aproxy event, an authentication event, a firewall event, an event from aweb gateway, a virtual private network (VPN) connection event, anintrusion detection system event, a network traffic analyzer event, oran event generated from a malware engine.

Each parser can implement a set of steps. Depending on what type of datathe data intake and preparation stage is currently processing, in someembodiments, the initial steps can including using regular expression toperform extraction or stripping. For example, if the data is a systemlog (syslog), then a syslog regular expression can be first used tostrip away the packet of syslog (i.e., the outer shell of syslog) toreveal the event message inside. Then, the parser can tokenize the eventdata into a number of tokens for further processing.

The field mapper 808 can map the extracted tokens to one or morecorresponding fields with predetermined meanings. For example, the dataformat can assist the field mapper 808 to identify and extract entitiesfrom the tokens, and more specifically, the data format can specifywhich of the extracted tokens represent entities. In other words, thefield mapper 808 can perform entity extraction in accordance with thoseembodiments that can identify which tokens represent entities. An entitycan include, for example, a user, a device, an application, a session, auniform resource locator (URL), or a threat. Additionally, the dataformat can also specify which tokens represent actions that have takenplace in the event. Although not necessarily, an action can be performedby one entity with respect to another entity; examples of an actioninclude use, visit, connect to, log in, log out, and so forth. In yetanother example, the filed mapper 808 can map a value extracted to a keyto create a key-value pair, based on the predetermined data format.

The entity extraction performed by the field mapper 804 enables thesecurity platform to gain potential insight on the environment in whichthe security platform is operating, for example, who the users are, howmany users there may be in the system, how many applications that areactually being used by the users, or how many devices there are in theenvironment.

A. Event Relationship Discovery/Mini-Graphs

FIGS. 9A and 9B show an example event relationship discovery andrecordation technique, which can be implemented in the data intake andpreparation stage. To facilitate description, FIGS. 9A and 9B areexplained below with reference to FIG. 8. The relationship discovery andrecordation technique can be performed by, for example, the relationshipgraph generator 810. Specifically, after the entities are identified inthe tokens, the relationship graph generator 810 is operable to identifya number of relationships between the entities, and to explicitly recordthese relationships between the entities. Some implementations of therelationship graph generator 810 generate a single relationship graphfor each event; such an event-specific relationship graph may also becalled a “mini-graph.” Further, some implementations incorporate thegenerated relationship graph into the event data that represents theevent, in the form of a data structure representing the relationshipgraph. A graph in the context of this description includes a number ofnodes and edges. Each node in the relationship graph represents one ofthe entities involved in the event, and each edge represents arelationship between two of the entities. In general, any event involvesat least two entities with some relationship between them (e.g., adevice and a user who accesses the device) and therefore can berepresented as an event-specific relationship graph.

In some implementations, the graph generator 810 can identify arelationship between entities involved in an event based on the actionsthat are performed by one entity with respect to another entity. Forexample, the graph generator 810 can identify a relationship based oncomparing the action with a table of identifiable relationships. Such atable of identifiable relationship may be customizable and provides theflexibility to the administrator to tailor the system to his datasources (described above). Possible relationships can include, forexample, “connects to,” “uses,” “runs on,” “visits,” “uploads,”“downloads,” “successfully logs onto,” “restarts,” “shuts down,”“unsuccessfully attempts to log onto,” “attacks,” and “infects.” Also,the identified relationship between the entities can be indicative ofthe action, meaning that the identifiable relationship can include theaction and also any suitable inference that can be made from the action.For example, an event that records a GET command (which is an action)may indicate that the user is using a machine with a certain IP addressto visit a certain website, which has another IP address. In practice,however, the number of identifiable relationships can be directlycorrelated to the size of the graph, which may impact the securityplatform's responsiveness and performance. Also, identifiablerelationships can include a relationship between entities of the sametype (e.g., two users) or entities of different types (e.g., user anddevice).

In some embodiments, specific details on how to construct the edges andthe identifiable relationships are recorded in the configuration file(e.g., snippet). For example, a portion of the configuration file canspecify, for the relationship graph generator 810, that an edge is to becreated from an entity “srcUser” to another entity “sourceIP,” with arelationship that corresponds to an event category to which the eventbelongs, such as “uses.”

FIG. 9A illustrates raw event data 900 received by the data intake andpreparation stage. The raw event data 900, representing an event thatoccurs, are log data generated by a web gateway server. The web gatewayis located where network traffic in and out the environment goesthrough, and therefore can log the data transfer and web communicationfrom a system inside the environment. The particular event asrepresented by the event data 900 indicates that, at a particular pointof time identified by the timestamp, the user “psibbal” uses the IPaddress “10.33.240.240” to communicate with an external IP address“74.125.239.107,” and transfers 106 bytes of data. The status code ofthat event is “200,” and the event is a TCP event where the HTTP statusis “GET.” As illustrated, the event data 900 also includes a significantamount of additional information.

Using the aforementioned techniques (e.g., the parsers 806, and thefield mapper 808), the graph generator 810 can readily identify that theevent represented in the FIG. 9A involves a number of entities, such asthe user “psibbal,” the source IP “10.33.240.240,” the destination IP“74.125.239.107,” and an URL “sample.site.com.” The graph generator 810also identifies that an action “GET” is involved in the event.Accordingly, the graph generator 810 can compare the action to the tableof identifiable actions, identify one or more relationships between theentities, and create an event-specific relationship graph 902 based onthe event. As shown in FIG. 9B, the relationship graph 902 includes theentities that are involved in the events. Each entity is represented bya different node. The relationship graph 902 also includes edges thatlink the nodes representing entities. The identified relationshipsbetween the entities are the edges in the graph 902. The relationshipgraph 902 can be stored in known data structures (e.g., an array)suitable for representing graphs that have nodes and edges.

Note, however, that the components introduced here (e.g., the graphgenerator 810) may be tailored or customized to the environment in whichthe platform is deployed. As described above, if the networkadministrator wishes to receive data in a new data format, he can editthe configuration file to create rules (e.g., in the form of functionsor macros) for the particular data format including, for example,identifying how to tokenize the data, identifying which data are theentities in the particular format, and/or identifying the logic on howto establish a relationship. The data input and preparation stage thencan automatically adjust to understand the new data format, identifyidentities and relationships in event data in the new format, and createevent relationship graphs therefrom.

Then, in some embodiments, the graph generator 810 attaches therelationship graph 902 to the associated event data 900. For example,the graph 902 may be recorded as an additional field of the event data900. In alternative embodiments, the relationship graph 902 can bestored and/or transferred individually (i.e., separate from the eventdata 900) to subsequent nodes in the security platform. After additionalprocesses (e.g., identity resolution, sessionization, and/or otherdecorations) in the data intake and preparation stage, the event data900 including the relationship graph 902 can be sent to a distributedmessaging system, which may be implemented based on Apache Kafka™. Themessaging system can in turn send the event data 900 to an eventprocessing engine (e.g., a machine learning model execution andanalytics engine, such as the complex event processing engine introducedhere and described further below) for further processing. As describedfurther below, the event processing engine is operable to use machinelearning models to perform analytics based on the events and, in someinstances, in conjunction with their associated relationship graphs, tosecurity-oriented anomalies and threats in the environment.

The messaging system (e.g., Apache Kafka™) can also accumulate oraggregate, over a predetermined period of time (e.g., one day), all therelationship graphs that are generated from the events as the eventscome into the security platform. Particularly, note that certain typesof behavioral anomalies and threats can become more readily identifiablewhen multiple events are compared together, and sometimes suchcomparison may even be the only way to identify the anomalies and/orthreats. For example, a beaconing anomaly happens when there is a devicein the network that communicates with a device outside the network in anunexpected and (mostly) periodic fashion, and that anomaly would becomemore identifiable when relationship graphs associated with all thedevice's related beacons are combined into a composite relationshipgraph. As such, at the messaging system, the relationship graphs(mini-graphs) for all events, or at least for multiple events, can becombined into a larger, composite relationship graph. For example, acomputer program or a server can be coupled to the messaging system toperform this process of combining individual relationship graphs into acomposite relationship graph, which can also be called an enterprisesecurity graph. The composite relationship graph or enterprise securitygraph can be stored, for example, as multiple files, one file for eachof multiple predetermined time periods. The time period depends on theenvironment (e.g., the network traffic) and the administrator. In someimplementations, the composite relationship graph is stored (or “mined”in data mining context) per day; however, the graph mining time periodcan be a week, a month, and so forth.

In some embodiments, event-specific relationship graphs are merged intothe composite relationship graph on an ongoing basis, such that thecomposite relationship graph continuously grows over time. However, insuch embodiments it may also be desirable to remove (“age out”) datadeemed to be too old, from the composite relationship graph,periodically or from time to time.

In some embodiments, the nodes and edges of the composite graph arewritten to time namespaces partitioned graph files. Then, each smallersegment can be merged with a master partition (e.g., per day). The mergecan combine similar nodes and edges into the same record, and in someembodiments, can increase the weight of the merged entity nodes. Notethat the exact order of the events' arrival becomes less important,because even if the events arrive in an order that is not the same ashow they actually took place, as long as the events have timestamps,they can be partitioned into the correct bucket and merged with thecorrect master partition. Some implementations provide that thecomposite graphs can be created on multiple nodes in a parallelizedfashion.

In this manner, this composite relationship graph can include allidentified relationships among all identified entities involved in theevents that take place over the predetermined period of time. As thenumber of events received by the security platform increases, so doesthe size of this composite relationship graph. Therefore, even though arelation graph from a single event may not carry much meaning from asecurity detection and decision standpoint, when there are enough eventsand all the relationship graphs from those events are combined into acomposite relationship graph, the composite relationship graph canprovide a good indication of the behavior of many entities, and thequality/accuracy of this indication increases over time as the compositerelationship graph grows. Then, the subsequent processing stages (e.g.,the complex processing engine) can use models to perform analytics onthe composite relationship graph or on any particular portion (i.e.,“projection”, discussed further below) of the composite relationshipgraph. In some embodiments, the composite relationship graph ispersistently stored using a distributed file system such as HDFS™.

In some embodiments, when various individual events' relationship graphs(along with their associated decorated events) are stored in themessaging system but have not yet been combined to create the compositerelationship graph, each such event's relationship graph can be furtherupdated with any information (e.g., anomalies) that is discovered bydownstream processes in the security platform. For example, if an eventis found to be an anomalous, then the relationship graph associated withthat anomalous event can be updated to include this information. In oneexample, the individual relationship graph of that anomalous event isrevised to include an anomaly node (along appropriate edges), so thatwhen the composite relationship graph is created, it can be used todetermine what other entities might be involved or affected by thisanomaly.

At least in some embodiments, the composite graph enables the securityplatform to perform analytics on entity behaviors, which can be asequence of activities, a certain volume of activities, or can be customdefined by the administrator (e.g., through a machine learning model).By having an explicit recordation of relationships among the events, therelationship graph generator 810 can enable the analytics enginesintroduced here (e.g., the complex processing engine) to employ variousmachine learning models, which may focus on different portions oraspects of the discovered relationships between all the events in theenvironment, in order to detect anomalies or threats.

B. Identity Resolution (IR) and Device Resolution (DR)

FIG. 10 shows an example identity resolution technique based on theinformation in the events, which can be implemented in the data intakeand preparation stage described above. To facilitate description, FIG.10 is explained below with reference to FIG. 8. Identity resolution canbe performed by, for example, the identity resolution module 812.Specifically, after the entities are identified in the tokens, theidentity resolution module 812 is operable to perform an identityresolution, which enables keeping track of which user logged into whichparticular computer system or device across the network.

In the context of computer security and especially unknown threatdetection, information about a user's behavior can be very important.However, as previously discussed, not all events/activities/logs includeuser information. Consider a typical firewall event as an example.Except for a few advanced firewall products, many typical firewalls donot know and do not record the user's identity in an event. Therefore,many times even when a particular communication is determined to bemalicious, traditional security products are unable to attribute themalicious behavior to a particular user. Thus, when logs or device-levelevents do not capture the user information, the identity resolutionmodule 812 in the data intake and preparation stage can attribute thoseevents (and behaviors) to the right user.

In addition, traditional solutions for identity resolution adopttechniques that are too simplistic and lack responsiveness to anychanges to the environment. For example, one traditional technique maybe a simple lookup, such as where the administrator maintains a resourceattribution file that records a particular IP address belongs to aparticular person. However, such a file is often hard to keep accurateand easily becomes obsolete, especially when the amount of the devicesin the environment is very large, as is often the case in today'senvironment.

Accordingly, the security platform introduced here can perform identityresolution based on the facts. The identity resolution module 812 cangain the knowledge by observing the system environment (e.g., based onauthentication logs), thereby building the intelligence to make aneducated identity resolution determination. That is, the identityresolution module 812 is able to develop user identity intelligencespecific and relevant to the system's environment without any explicituser identity information.

To facilitate this fact-based identity resolution functionality in thesecurity platform, the identity resolution module 812 can utilize amachine learning model to generate and track a probability ofassociation between a user and a machine identifier. Specifically, afterthe entities in event data that represents an event are extracted (e.g.,by the field mapper 808), the identity resolution module 812 canidentify whether the event data includes a user identifier and/or amachine identifier, and can create or update the probability ofassociation accordingly. As is discussed in more detail in othersections of this disclosure, the model initiated by the identityresolution module 812 can, in some embodiments, obtain the informationit needs, e.g., obtaining machine identifiers in an event, through oneor more interfaces. A machine identifier is an identifier that can beassociated with a machine, a device, or a computing system; for example,a machine identifier can be a media access control (MAC) address, or anInternet Protocol (IP) address. Different machine identifiers can begenerated by the same machine. A user identifier is an identifier thatcan be associated with a user; for example, a user identifier can be auser login identifier (ID), a username, or an electronic mail address.Although not illustrated in FIG. 8, some embodiments of the identityresolution module 812 can resolve a user identity of a particular userby, for example, querying a database using a user identifier as a key.The database, which may be a human resource management system (HRMS),can have records indicating a number of user identifiers that areregistered to the user identity. Note that, in some alternativeembodiments, a user identifier may be directly treated as a user forsimpler implementation, even though such implementation may not be anideal one because behaviors of the same user may not be detected becausethe user has used different user identifiers.

More specifically, a machine learning model can have different phases,for example, a training phase (after initiation and before ready) and anactive phase (after ready and before expiration). In a training phase ofa machine learning model, if an event that is received involves both auser and a machine identifier (e.g., if the event data representing theevent has both a user identifier and a machine identifier), then machinelearning model that is employed by the identity resolution module 812can use this event to create or update the probability of associationbetween the user and the machine identifier. For example, when anauthentication event is received (e.g., when a user logs into aparticular machine) and involves a user (e.g., identified by a useridentifier such as a username) and a machine identifier, the modellearns that the user is now associated with the machine identifier, atleast for a period of time until the user logs out or times out from theparticular machine.

As more events are received, the model can become increasingly bettertrained about the probability of association between the user and themachine identifiers. In some embodiments, the identity resolution module812 creates a probabilistic graph to record a probability of associationfor each user it is currently tracking. The probabilistic graph caninclude peripheral nodes, a center node, and edges. An example of suchprobabilistic graph 1000 is shown in FIG. 10. In graph 1000, nodes 1004,1006, 1008, and 1010 are the peripheral nodes representing the machineidentifiers. Node 1002 is the center node representing the user. Edgesbetween each peripheral node and the center node represent theprobability of association between the particular machine identifier andthe user. According to some embodiments, the machine learning modelsused for identification resolution are user specific. It is also notedthat the machine learning models used in the identity resolution (anddevice resolution, introduced below) are generally simpler than thosemodels that would be used for anomaly and threat detection. In manyembodiments, the models that are used in the identity resolution and/ordevice resolution are time-sequenced probabilistic graphs, in which theprobability changes over time.

According to a number of embodiments, the models that are used togenerate and track the probability of association between each user andpossible machine identifiers are time-dependent, meaning that a resultfrom the models has a time-based dependence on current and past inputs.The time dependence is useful to capture the scenario where a device isfirst assigned or given to a particular user, and is subsequentlyreassigned to a different user, which happens often in a largeorganization. To achieve this, in some embodiments, the identityresolution module 812 can initiate, for a given user, different versionsof the machine learning model at different point of time, and eachversion may have a valid life time. As events related to the given userarrive, versions of a machine learning model are initiated, trained,activated, (optionally) continually updated, and finally expired.

The models can be trained and, in some implementations, continuallyupdated after their activation, by relevant events when the events arereceived. An example of a relevant event is an authentication event,which inherently involves a user (e.g., which may be represented by auser identifier) and a number of machine identifiers (e.g., an IPaddress or a MAC address). Depending on the model, other criteria for anevent to be considered relevant for model training and/or updatingpurposes may include, for example, when a new event includes aparticular machine identifier, a particular user identifier, and/or therecency of the new event. Moreover, some models may assign a differentweight to the new event based on what type of event it is. For example,given that the new event is an authentication event, some models assignmore weight to a physical login type of authentication event than to anyother type of authentication event (e.g., a remote login).

Depending on the particular deployment, the machine learning model canbe considered trained and ready when one or more criteria are met. Inone example, a version of the model can be considered trained when acertain number of events have gone through that version of the model. Inanother example, a version of the model can be considered trained when acertain time period has passed after the version of the model isinitiated. Additionally or alternatively, a version of the model isconsidered trained when a certain number of criteria are met (e.g., whenthe model becomes sufficiently similar to another model). Additionaldetails of machine learning models that can be employed (includingtraining, readiness, activation, and expiration) by various engines andcomponents in the security platform are discussed in other sections ofthis disclosure.

After a version of a model is sufficiently trained (e.g., when theprobability of association exceeds a confidence threshold, which dependson the model's definition and can be tuned by the administrator for theenvironment), the identity resolution module 812 then can activate theversion of the model. Thereafter, when a new event arrives, if the newevent meets certain criteria for the identity resolution, the identityresolution module 812 can create a user association record (e.g., inmemory) indicative that the new event is associated with a particularuser. The criteria for the identity resolution can include, for example,when the new event includes a machine identifier (regardless of whetherit also includes a user identifier), and/or when the new event isreceived during a time period which the version is active. It isobserved that the identity resolution technique is especially useful tohelp identify an event that includes only a machine identifier but nouser identifier.

Based on this user association record, the identity resolution module812 can annotate the new event to explicitly connect the new event tothe particular user. For example, the identity resolution module 812 canadd, as a field, the particular user's name to the new event in itsassociated event data. Alternatively, the identity resolution module 812can annotate the new event by adding a user identifier that belongs tothe particular user. In addition, the identity resolution module 812 cansend the user association record to a cache server that is implementedbased on Redis™.

With the fact-based identity resolution techniques disclosed herein, thesecurity platform has the ability to attribute an event that happens ona device to a user, and to detect behavioral anomalies and threats basedon that attribution. The security platform can achieve this without theneed of maintaining an explicit look-up file and irrespective of whatthe data source is (i.e., regardless of whether a data source for anevent includes a user identifier or not).

Although not illustrated in FIG. 8, an embodiment of the data intake andpreparation stage can also implement a device resolution module tocreate an association between one machine identifier and another. In amanner similar to how the identity resolution module 812 tracks thepossibility of association between a user and a machine identifier, thedevice resolution module can track the possibility of associationbetween a first machine identifier and a second machine identifier.Thereafter, when a new event is received, if the event includes thefirst machine identifier but not the second, the device resolutionmodule can create a machine association record indicative that the newevent having the first machine identifier is associated with the secondmachine identifier. Optionally, the machine identifier can be translatedinto a more user-friendly machine name, such as “Tony's Laptop.”

The device resolution technique can be particularly useful in anenvironment that includes a dynamic host configuration protocol (DHCP)service, and therefore a computer in the environment does not have astatic IP address. Because the same computer can potentially get adifferent IP address each time it starts in such environment, naivelyattributing a behavior to a particular IP address may lead to incorrectanalysis. In manners similar to the identity resolution, the deviceresolution can create a mapping between, for example, a MAC address andan IP address, which can remain valid for a period of time. One exampleof events where the relationship between a MAC address and an IP addresscan be found is the DHCP logs. Like identity resolution, such machineidentifier mapping can be dynamically updated as the time goes by andmore events are received. Whenever the environment changes, the deviceresolution module can derive a new mapping, meaning that the same IPaddress can become associated with a different, updated MAC address.Note that, for the particular case of DHCP services, it is generallyeasier to estimate when a particular version of a device resolutionmodel should expire, because a DHCP service setting typically includesexplicit lease expiration provisions.

C. Additional Event Decoration

The data intake and preparation stage can also include additional eventdecorators 814. Similar to how a format detector 804 may be customizedor how a new format detector may be added, the event decorators 814 canbe in the form of software code (e.g., in Java™) written by athird-party (e.g., the administrator) or can be added/configured throughthe configuration snippet. In some embodiments, the event decorators 814can include a geographical decorator, which can be configured todecorate the received events (e.g., by adding a field in the event datathat represents the events) so all events with an IP address receive anadditional field about their respective IP's geographical location. Inanother embodiment, the event decorators 814 can include a serveridentifier, which can explicitly annotate an event when the event isfrom a server. The server identifier can implement a look-up techniquein order to identify that a machine is being used as a server, or it canimplement heuristics and make a determination based on how many usershave logged into it within a predetermined time period. Other examplesof the event decorators 814 can include a Whois Lookup, Whitelisting,and so forth.

D. Event Views

FIG. 11 shows a diagram of a technique for providing uniform accessinterfaces (also called “event views”) to event data at the data intakeand preparation stage for an event processing engine (e.g., at asubsequent stage) to obtain relevant information from various kinds ofmachine data. To facilitate description, FIG. 11 is explained below withreference to FIG. 8.

The large variety of different types event data would make it difficultfor traditional data analysis platforms to perform automated, real-timeanalysis. Therefore, the data intake and decoration stage introducedhere can provide an uniform access interface for select informationcontained in the events. The uniform access interfaces described hereserve to decouple the main intelligence of the security platform (e.g.,the analytic models running therein) from the multiple, potentiallyheterogeneous data source inputs (which may be heterogeneous in nature(i.e., of different data types, formats, etc.)), and to create ahomogeneous way of access information contained in the events that areoriginated from these various input systems.

In particular, binding is a process in which unstructured data isprocessed and transformed into structured data. However, during binding,any information in the original, unstructured data becomes lost if notcaptured in the structured data. Accordingly, the data intake andpreparation stage introduced here generally implements the notion of a“late binding” schema, which means that the binding is only made when anoperation (e.g., a query) is made against the data. In contrast, an“early binding” schema generally means that data is transformed intostructured data (i.e., become bonded to data structures) at an earlystage, typically at data intake. Even though an early binding schema canprovide homogeneous ways to access the data (because the data becomesstructured after intake), using an early binding schema may risk losingpotentially important information, information that may later becomeparticularly important when it comes to determining unknown anomaliesand threats. On the other hand, unstructured data in various data formatpresents a technical problem to a systematic way to process these data,especially in an application (e.g., security platform) where both timeand accuracy are of the essence, because there is no convenient way toaccess the data using an uniform manner (i.e., using the same way toaccess select information in events that are in various data formats).

In other words, the data intake and preparation stage introduced heredoes not put the event data into any kind of fixed structure; thus, evenafter the application of the various preparation or pre-processingtechniques introduced here, the event data are still generally in theoriginal form (more importantly, retaining all the raw event data) afterthe data intake and preparation stage. In the manner introduced here,the event view enables the security platform to both implement latebinding and have a homogeneous way to access the unstructured eventdata.

According to some examples, an access interface, also called an “eventview”, can be implemented as a class (in object-oriented programmingterms, e.g., a Java™ class). An event view includes a name (e.g., viewidentifier) for subscription purposes. An event view can include anumber of fields to access certain attributes of an event; for example,the fields can be used by a machine learning model to identify whichsubset of the event data (e.g., serverIP, sourceIP, sourcePort, etc.) isthe information that the model wants to receive. The event view can alsoinclude a number of methods (in object-oriented programming terms) andlogic associated with the methods to access information generated basedon attributes of an event; for example, a method can be used by amachine learning model to obtain a randomness of a URL in an event(e.g., getRandomnessOfURL( )), in which the logic associated with themethod can include performing algorithmic operations to compute the URLagainst a predetermined set of URLs.

Regarding the late binding aspect, the binding is made only when a fieldin the event view is referenced or a method in the event view is called.Optionally, an event view can include an input for controlling actionsor operations that the logic associated with a method performs. Notethat any programming-related term of art used herein may, but does notnecessarily, have the same meaning as how the term may be used in atraditional programming sense; therefore, any term of art used herein isto be construed in the context of the present disclosure. In a number ofimplementations, the event views (e.g., the object-oriented classes) canbe stored in a library. When an event view is called (e.g., by the modelexecution library, which may be a part of an event processing enginesuch as the CEP engine), the event view can be loaded by, for example, aknown Java™ class loader.

In various embodiments, the data intake and decoration stage includes anevent view adder 816 that can provide the event views by adding one ormore view identifiers to the event data. A view identifier can be added,for example, as a field in the event data. The view identifiers allow adownstream entity (e.g., a complex event processing (CEP) engine) toreceive the select information through the event views identified by theview identifiers. For example, the information in the model registry(discussed herein in other sections) for each machine learning model candesignate one or more view identifiers to indicate the event views thatare of interest to the model, to identify the events of interest and toreceive select information about those events. In other words, thesecurity platform provides a mechanism for the machine learning modelsto subscribe (e.g., using the model registry) to a group of event viewsin order to receive select information about the events of interest aseach event of interest arrives. In a number of embodiments, the viewidentifiers are added to event data by the event view adder 816 on aper-event basis.

More specifically, the view identifiers can be added by the event viewadder 816 to an event at any suitable moment during the data intake andpreparation stage after the data connector 802 retrieves or receives theevent. The event view adder 816 can selectively add the view identifiersbased on the event data, and more precisely, based on an event categoryto which the event belongs. The event view adder 816 can also determinethe event category based on the type of machine that generated theevent. For example, a firewall event can be an event category. Otherexample event categories include authentication, network, entityacquisition, and so forth. Shown in FIG. 13 is a table 1300 includingexample event views available for event annotation in the data intakeand preparation stage.

A firewall event example is illustrated in FIG. 11. When a Cisco RSA™event (event data) 1100 arrives, the event view adder 816 firstdetermines that the machine that generated the event is a Cisco RSA™type (which may be defined in the configuration snippet by theadministrator). Based on the machine type, the event view adder 816determines (e.g., by performing a lookup of the event code in the eventagainst a list of Cisco RSA™ event codes) that the event belongs to afirewall event. Then, based on the configuration, the event view adder816 automatically adds to the event 1100 two view identifiers, namelyNetwork and Firewall. Note that the determination of which viewidentifiers should be added may be adjusted by the administrator (e.g.,via the configuration file) based on the knowledge of the devices in theenvironment, such that the added view identifiers (and the correspondingevent views) correctly reflect or correspond to the event category.

Thereafter, a downstream entity (e.g., the CEP engine) can run analyticson events using information about the plurality of events, for example,by using a machine learning model 1104. The machine learning model 1104can subscribe to the event views in, for example, the model registry(e.g., by specifying corresponding view identifiers). In variousembodiments, the subscription causes or allows the automatic routing ofthe select information to the machine learning model 1104. As previouslydescribed, the information accessible via the event views can include:information generated by logic included in the interface (e.g., throughthe methods in the interfaces), and/or a predefined subset of a completeset of the event data (e.g., through the fields).

FIG. 12 shows a table 1200 of example uniform access interfaces (“eventviews”) that can be implemented in the data intake and preparationstage. FIGS. 13A and 13B collectively show a table 1300 that includesexample anomalies that can be identified by machine learning models, aswell as various event views and fields that can be used by the models toreceive relevant information about the events for performing furtheranalytics.

E. Sessionization

FIG. 14 shows a technique for session correlation, also called“sessionization,” that can be implemented in conjunction with otherintroduced techniques (e.g., identity resolution) in the data intake andpreparation stage. In addition to what is discussed above with respectto identity resolution and device resolution, the data intake andpreparation stage can further include a session tracker and a sessionresolver (not illustrated in FIG. 8 for simplicity).

Generally, sessionization can be created by using the same or similardata structure as that used for correlating users with devices inidentity resolution. When the beginning or end of a session is detected,the event data associated with events from the session should beexplicitly marked (e.g., as a field in the event data). Then, with theidentity resolution and the device resolution techniques, all dataevents resolved to the user within the time window of an active sessionare associated with the session. The data intake and preparation enginecan also mark certain events for session correlation, for example,events that may indicate a remote network login such as using a remotedesktop protocol (RDP) or a secure shell (SSH) protocol to log intoanother device. Further, because a network login to a target device alsocreates a new session, the current session should be correlated with thenew session. This correlation is referred to herein as session lineage.As shown in FIG. 14, an active directory (AD) session is first startedon the machine with the IP address of 10.245.0.6 by user “zzsmssvc1” attime 10:13 PM. However, this user then started an SSH session to loginto a new system as “root.” These two sessions, along with anyanomalies detected during these two sessions, should all be attributedto the user “zzsmssvc1.” These two sessions are said to have sessionlineage, and can be correlated with each other using the sessionizationtechnique introduced here.

More specifically, every session that is tracked be assigned with asession identifier (“sessionId”) and a correlation identifier(“correlationId”). The session identifier is used to identify the samesession, and the correlation identifier is used to find other sessionsthat can possibly be in the same lineage. The session tracker is used totrack the user sessions based on login/logout events, for example, fromactive directory (AD), virtual private network (VPN), and secure shell(SSH) logs. In some examples, the session tracker can create andmaintain session states in a sessions database. The session tracker canalso link sessions based on session linking events (e.g. an AD Eventwith code 5156, which may correspond to a remote-desktop connection frommachine-A to machine-B). The session resolver queries the sessiondatabase using user, device and event time information from data event.Then, if there is any closely matching active session found in thesession database (e.g., which can be determined based on the event'stime), then a corresponding session identifier (e.g., “sessionId”) canbe assigned to the data event.

Details on how to perform the session tracking may vary depending onwhat existing techniques (such as those introduced here) are implementedin the data intake and preparation stage. Introduced here is a specificimplementation where session correlation is performed after entityextraction, device resolution and identity resolution, and event viewassignment. Therefore, instead of using specific attributes of dataevents from various data formats, the components that are logicallylocated after event view assignment, which include the session tracker,can conveniently operate over sets of normalized attributes (e.g., fromcalling a specific event view for obtaining select information,introduced above). With the specific information based on the attributeson the event, the session tracker can inspect the event data todetermine whether the event represented by the event data belongs to anysession of interest (e.g., AD, VPN, and SSH). If affirmative, then thesession tracker starts to track the event.

For example, if a new event arrives, and an event type is set as“SessionStart” (e.g., by using an “association” event view), then thatsignifies that a new session is created. (For simplicity of discussion,assume that this session is a session of interest.) The session trackerthen starts a tracking process by storing the new event in the sessiondatabase. The session is stored with information about start time, useridentifier (e.g., user account), device identifier (e.g., IP address),and sessionID (or perhaps a hash of the sessionID). According to thepresent embodiments, a derived property attribute “LinkContext” can alsobe generated from the event view, and the stored session also has itsLinkContext stored along with session information. An example of aLinkContext of a session may be an IP address along with the useraccount used.

With the new session created in the session database, a process threadstarts to automatically look for any preexisting session in the sessiondatabase that can be linked with the information provided by the newsession. Whether to link two sessions is determined based on comparingthree items: “from-session-link-context”, “to-session-link-context”, and“Link-Event time.” An example of the “from-session-link-context” is thecombination of the IP address of and the user account used on a sourcemachine from which the session is established. An example of the“to-session-link-context” is the combination of the IP address of andthe user account used on a target machine to which the session isestablished. The “Link-Event time” is the time that the new session isrecorded. Two existing sessions should be linked or correlated if thenewly added session (1) matches a link event time range, (2a) has amatch in one of its from-session-link-context or to-session-link-contextwith those of one existing session, and (2b) has at least a partialmatch in one of its from-session-link-context or to-session-link-contextwith those of another existing session.

Similar to what is shown in FIG. 14, a practical example of thissessionization technique would be where a user uses user account A tolog into a first machine of a first IP address, thereby creating a firstsession. Then, from the first machine, the same user uses user account Bto log into a second machine of a second IP address, thereby creating asecond session. The two existing sessions that are visible in theenvironment are that the first machine of the first IP address is loggedin by user account A, and that the second machine of the second IPaddress is logged in by user account B. Without sessionization, the twosessions would not be linked or correlated to each other. Now, if theuser actually uses remote desktop protocol (RDP) to login from the firstmachine to the second machine, then an RDP event is received. This RDPevent can be used by the sessionization technique introduced here todiscover that these two seemingly unrelated sessions are actuallyinitiated by the same user and should be correlated. This is because,using the aforementioned mechanisms and assuming the RDP event's time iswithin the valid range, the RDP event would have a match with the firstsession in its “from-session-link-context”, and have a match with thesecond session in its “to-session-link-context.”

If a matching link is not found, then additional linking can be done byan offline session scanner process, which can run at a configuredinterval (e.g., every 15 minutes). The offline session linking isdiscussed further below. Note that, if identity resolution is performed,then the user account may be further transformed into a user identity tomore accurately track the user for sessionization.

In some situations, the sessionization process may receive an eventindicating that a session may have been timed out. In such case, a newsession entry can be created in the session database with a state “TimedOut.” For example, an already timed out session may be identified if thesum of a session start time and an expiration duration is less than thecurrent system time. When a user log-out event is received, acorresponding session is marked as “User Ended” in the session database.

Note that, in certain types of events, session ending events do notcontain any specific context (e.g., lack a context that may be used asthe LinkContext, and therefore unable to be used for matching purposesin the session database). For example, a certain type of AD event maycontain only the from and to IP address of connection, but not the useraccount information. In such case, identity resolution (IR) lookup canhelp identify that existing session if the IR takes place beforeprocessing the session end event.

In some embodiments, for effective session linking and user assignment,all events pass through the session assignment logic (e.g., the sessiontracker and the session resolver) in the data intake and preparationstage. Based on session-lookup context (e.g., using event views) in anevent, the session assignment logic tries to identify if there is anyopen session at time T of the event. This can be achieved by locatingthose sessions with the time T included between their start time and endtime. Such identified session can be associated with the event, and ifsuch event triggers an anomaly (e.g., in downstream processing), thenthe anomalous event can be annotated or otherwise associated with thesessionId of the identified session. Such anomalies with the associatedsession(s) can be displayed in the user interface for review. Further,if a session identified for an event has other sessions linked to thesession, then the current user on the event is replaced with the user ofthe root (source) session.

Additionally, one aspect of the sessionization technique includesoffline session linking Specifically, if user login/logout events orevents that indicate possible connection between two sessions are out oforder, then session linking may be missed in real-time. To resolve thisout of order data problem, a session linking process can run at aconfigurable intervals (e.g., configured in the configuration file).This process looks for any pending sessions that can be linked in thesession database, and links the appropriate sessions together. Also,when this session linking process is executed, if any of the linkedsessions is already associated with an anomaly, then the anomaly willalso include the root session's sessionID.

IV. Complex Event Processing (CEP) Engine Utilizing Machine LearningModels

Certain embodiments introduced here include a machine learning- (ML-)based complex event processing (CEP) engine that provides a mechanism toprocess data from multiple sources in a target computer network toderive anomaly-related or threat-related conclusions in real-time sothat an appropriate response can be formulated prior to escalation. ACEP engine is a processing entity that tracks and reliably analyzes andprocesses unbounded streams of electronic records to derive a conclusiontherefrom. An “unbounded stream” in this context is an open-endedsequence of data that is continuously received by the CEP engine. Anunbounded stream is not part of a data container with a fixed file size;instead, it is a data sequence whose endpoint is not presently known bythe receiving device or system. In a computer security context, a CEPengine can be useful to provide real-time analysis of machine data toidentify anomalies.

The ML-based CEP engine described herein enables real-time detection ofand response to computer security problems. For example, the input dataof the ML-based CEP engine includes event feature sets, where each eventfeature set corresponds to an observable event in the target computernetwork.

A conventional CEP engine relies on user-specified rules to process anincoming event to identity a real-time conclusion. User-specified rulesbenefit from its computational simplicity that makes real-timecomputation plausible. However, conventional CEP engines rely on peopleto identify known event patterns corresponding to known conclusions.Accordingly, conventional CEP engines are unable to derive conclusionsbased on patterns or behaviors that are not previously known to authorsof the user-specified rules. Conventional CEP engines do not considerhistorical events. The added complexity (e.g., memory consumption andprocessing power requirement) associated with the inclusion of thehistorical events would likely overtax an otherwise resource-limitedcomputer system that supports a conventional CEP engine.

Certain embodiments introduced here include an ML-based CEP engine thatutilizes distributed training and deliberation of one or more machinelearning models. “Deliberation” of a machine learning model or a versionof a machine learning model involves processing data through a modelstate of the machine learning model or version of the machine learningmodel. For example, deliberation can include scoring input dataaccording to a model deliberation process logic as configured by themodel state. The ML-based CEP engine processes event feature setsthrough the ML models to generate conclusions (e.g., security-relatedanomalies, security-related threat indicators, security-related threats,or any combination thereof) in real-time. “Real-time” computing, or“reactive computing”, describes computer systems subject to a processingresponsiveness restriction (e.g., in a service level objective (SLO) ina service level agreement (SLA)). In real-time processing, conclusionsare reached substantially immediately following the receipt of inputdata such that the conclusions can be used to respond the observedenvironment. The ML-based CEP engine continuously receives new incomingevent feature sets and reacts to each new incoming event feature set byprocessing it through at least one machine learning model. Because ofreal-time processing, the ML-based CEP engine can begin to process atime slice of the unbounded stream prior to when a subsequent time slicefrom the unbounded stream becomes available.

In some embodiments, the ML-based CEP engine is implemented as, orwithin, analysis module 330 in FIG. 8 and couples to a data intake andpreparation stage (data intake and preparation stage 800 of FIG. 8) thatreceives raw event data from a target-side computer system (e.g.,multiple data sources from the target-side computer system). Thetarget-side computer system is operated in a target computer network,which the ML-based CEP engine monitors for computer security issues. Thetarget-side computer system collects machine data from the targetcomputer network as the raw event data. The data intake and preparationstage creates an event feature set from raw event data pertaining to asingle machine-observed event or a sequence of machine-observed events.The event feature set can include at least a subset of the raw eventdata; metadata associated with the raw event data; transformed,summarized, and/or normalized representation of portions of the rawevent data; derived attributes from portions of the raw event data;labels for portions of the raw event data; or any combination thereof.To facilitate real-time processing in the ML-based CEP engine, the dataintake and preparation stage can process, in real-time, the raw eventdata as it is received. The data intake and preparation stage and theML-based CEP engine can store its inputs and outputs in non-persistentmemory (e.g., volatile memory), such that all I/O operations of theML-based CEP engine and the data intake and preparation stage operate onthe non-persistent memory. Operations in non-persistent memory can helpreduce the time lag of the ML-based CEP engine to satisfy the processingresponsiveness restriction. In some embodiments, instead of thenon-persistent memory, the inputs and outputs are stored in solid-statememory (e.g., one or more Flash drives), which is typically faster thanhard disks and other non-solid-state data storage devices.

The ML-based CEP engine trains and retrains (e.g., updates) the machinelearning models in real-time and applies (e.g., during the modeldeliberation phase) the machine learning models in real-time.Parallelization of training and deliberation enables the ML-based CEPengine to utilize machine learning models without preventing orhindering the formation of real-time conclusions. The ML-based CEPengine can be implemented on a distributed computation system (e.g., adistributed computation cluster) optimized for real-time processing. Forexample, a distributed computation system, such as Apache Storm™, canimplement task parallelism instead of data parallelism. Storm is an opensource distributed real-time computation system. In other embodiments,the distributed computation system can be implemented with dataparallelism, such as Apache Spark™ or Apache Spark Streaming. Spark isan open source cluster computing framework. The distributed computationsystem can be coupled to other distributed components, such as acluster-based cache (e.g., Redis), a distributed file system (e.g.,HDFS), a distributed resource management system, or any combinationthereof. The ML-based CEP engine can implement additional services tofacilitate the distributed training and deliberation of machine learningmodels, such as a distributed messaging platform and a central servicefor distributed synchronization and centralized naming and configurationservices.

The ML-based CEP engine disclosed herein is advantageous in comparisonto conventional CEP engines at least because of its ability to recognizeunknown patterns and to incorporate historical data withoutoverburdening the distributed computation system by use of machinelearning models. Because the ML-based CEP engine can utilizeunsupervised machine learning models, it can identify entity behaviorsand event patterns that are not previously known to security experts. Insome embodiments, the ML-based CEP engine can also utilize supervised,semi-supervised, and deep machine learning models.

The ML-based CEP engine is further capable of condensing and summarizinghistorical knowledge by observing streams of events to train the machinelearning models. This enables the ML-based CEP engine to include a formof historical comparison as part of its analysis without consuming toomuch data storage capacity. For example, the ML-based CEP engine cantrain a decision tree based on the historical events. In this case, thetrained decision tree is superior to a user-specified rule because itcan make predictions based on historical sequence of events. In anotherexample, the ML-based CEP engine can train a state machine. Not only isthe state machine trained based on a historical sequences of events, butit is also applied based on a historical sequence of events. Forexample, when the ML-based CEP engine processes event feature setscorresponding to an entity through the state machine, the ML-based CEPengine can track a number of “states” for the entity. These run-timestates (different from a “model state” as used in this disclosure)represent the history of the entity without having to track everyhistorical event involving the entity.

The machine learning models enable the ML-based CEP engine to performmany types of analysis, from various event data sources in variouscontextual settings, and with various resolutions and granularitylevels. For example, a machine learning model in the ML-based CEP enginecan perform entity-specific behavioral analysis, time series analysis ofevent sequences, graph correlation analysis of entity activities, peergroup analysis of entities, or any combination thereof. For example, thedata sources of the raw event data can include network equipment,application service servers, messaging servers, end-user devices, orother computing device capable of recording machine data. The contextualsettings can involve scenarios such as specific networking scenarios,user login scenarios, file access scenarios, application executionscenarios, or any combination thereof. For example, an anomaly detectedby the machine learning models in the ML-based CEP engine can correspondto an event, a sequence of events, an entity, a group of entities, orany combination thereof. The outputs of the machine learning models canbe an anomaly, a threat indicator, or a threat. The ML-based CEP enginecan present these outputs through one or more output devices, such as adisplay or a speaker.

Examples of entity-specific behavioral analysis include hierarchicaltemporal memory processes that employ modified probabilistic suffixtrees (PST), collaborative filtering, content-based recommendationanalysis, statistical matches in whitelists and blacklists using textmodels, entropy/randomness/n-gram analysis for uniform resource locators(e.g., URLs), other network resource locators and domains (AGDs), rarecategorical feature/association analysis, identity resolution models forentities, land speed violation/geo location analysis, or any combinationthereof. Examples of time series analysis of event sequences includeBayesian time-series statistical foundation for discrete time-seriesdata (based on variable-memory Markov models and context-treeweighting), dynamic thresholding analysis with periodicity patterns atseveral scales, change-point detection viamaximum-a-posteriori-probability (MAP) modeling, cross-correlation andcausality analysis via variable-memory modeling and estimation ofdirected mutual information, outlier analysis, or any combinationthereof.

Examples of graph-based analysis of entity activities include commandand control detection analysis, beaconing detector, device, IP, domainand user reputation analysis, lateral movement detector, dynamicfingerprinting for users/devices, or any combination thereof. Examplesof peer group analysis of entities include grouping of entities based onsimilarity and page rank, social-neighborhood graph-based clustering,online distributed clustering, clustering for bipartite and genericgraphs, or any combination thereof.

FIG. 15 is a block diagram of an ML-based CEP engine 1500, in accordancewith various embodiments. The ML-based CEP engine 1500 receives anunbounded stream 1502 of event feature sets as its input. For example,the ML-based CEP engine 1500 receives the unbounded stream 1502 from thedata intake and preparation stage 800 of FIG. 8. Each event feature setcorresponds to a machine-observed event. The ML-based CEP engine 1500can train machine learning models using the unbounded stream 1502. TheML-based CEP engine 1500 can also compute security-related conclusions(e.g., an anomaly, a threat indicator, or a threat as described in thisdisclosure) by processing at least a subset of the event feature sets(e.g., from the unbounded stream 1502) through the machine learningmodels.

The ML-based CEP engine 1500 includes a cache component 1512, adistributed filesystem 1514, a messaging platform 1518, and adistributed computation system 1520. The ML-based CEP engine 1500 caninclude other data access systems. For example, the data access systemsinclude a relational database (e.g., a structured query language (SQL)database), a non-relational database (e.g., HBase), a time seriesdatabase, a graph database, or any combination thereof. The ML-based CEPengine 1500 can include other resource management systems (e.g., adistributed coordination system, such as ZooKeeper). The cache component1512 can be non-persistent memory (e.g., volatile memory). The cachecomponent 1512 can be a distributed cache, such as a cluster-based cacheor a peer-to-peer cache. For example, the cache component 1512 isimplemented in REDIS, an open source key-value cache.

The distributed filesystem 1514 stores data on a cluster of computingmachines to provide high aggregate bandwidth across the cluster. Thedistributed filesystem 1514 includes at least a name node and aplurality of data nodes. Each data node serves blocks of data over anetwork using a file access protocol (e.g., block protocol or file-basedprotocol) specific to the distributed filesystem 1514. For example, thedistributed filesystem 1514 is implemented according to the Hadoopdistributed file system (HDFS).

The distributed filesystem 1514 stores a model registry 1530, a modelstore 1532, and a model execution code base 1534. In some embodiments,the model execution code base 1534 is part of the model registry 1530.The model registry 1530 stores model type definitions. A model typedefinition can configure whether a distributed computation system isresponsible for a model type and can configure a model training workflow(i.e., a workflow of how to train machine learning models of a modeltype) and a model deliberation workflow (i.e., a workflow of how toapply machine learning models of a model type) of the model type. Themodel store 1532 stores model states that represent machine learningmodels or versions of the machine learning models. A model state,described further below, is a collection of numeric parameters in a datastructure. A model training process thread produces and updates a modelstate. A model deliberation process thread is configured by a modelstate to process event feature sets into security-related conclusions.The model execution code base 1534 stores process logics for runningmodel-related process threads. In some embodiments, the model executioncode base 1534 also stores process logics associated with event views.

In some embodiments, the content of the distributed file system 1514 canbe shared with another distributed computation system (e.g., a batchdata processing engine discussed in various parts of this disclosure).For example, a model state stored in the model store 1532 representing amachine learning model or a version of a machine learning model can beshared with the other distributed computation system. For anotherexample, one or more model types in the model registry 1530 and themodel execution code base 1534 can be shared with the other distributedcomputation system.

The cache component 1512 stores an event feature store 1540 and asecurity-related conclusion store 1542. The cache component 1512 cancache (e.g., the most recently used or most recently received eventfeature sets) from the unbounded stream 1502 in the event feature store1540. The cache component 1512 can cache the security-relatedconclusions (e.g., the most recently produced or the most recently used)in the security-related conclusion store 1542. The ML-based CEP engine1500 can compute the security-related conclusions by processing theevent feature sets through the machine learning models. In someembodiments, the cache component 1512 stores copies or references toentries in the model store 1532. In some embodiments, the cachecomponent 1512 stores copies or references to entries in the modelregistry 1530. In some embodiments, the cache component 1512 storescopies or references to at least a portion of the model execution codebase 1534.

The messaging platform 1518 provides a computer application service tofacilitate communication amongst the various system components of theML-based CEP engine 1500 and between external systems (e.g., the dataintake and preparation stage) and the ML-based CEP engine 1500. Forexample, the messaging platform 1518 can be Apache Kafka, an open-sourcemessage broker utilizing a publish-subscribe messaging protocol. Forexample, the messaging platform 1518 can deliver (e.g., viaself-triggered interrupt messages or message queues) the event featuresets from the unbounded stream 1502 to model-related process threads(e.g., one or more of model training process threads, model deliberationprocess threads, and model preparation process threads) running in thedistributed computation system 1520. The messaging platform 1518 canalso send data within the cache component 1512 or the distributedfilesystem 1514 to the model-related process threads and between any twoof the model-related process threads.

For the ML-based CEP engine 1500, the distributed computation system1520 is a real-time data processing engine. The distributed computationsystem 1520 can be implemented on the same computer cluster as thedistributed filesystem 1514. In some embodiments, an ML-based batchprocessing engine runs in parallel to the ML-based CEP engine. In thoseembodiments, the ML-based batch processing engine can implement adistributed computation system configured as a batch processing engine(e.g., using a data parallelism architecture). The system architectureof the ML-based batch processing engine can be identical to the ML-basedCEP engine 1500, except for the distributed computing platform enginerunning on the distributed computation system, and the ML-based batchprocessing engine's inputs including batch data containers of eventfeature sets (instead of an unbounded stream of incoming event featuresets).

The distributed computation system 1520 can be a distributed computationcluster. The distributed computation system 1520 coordinates the use ofmultiple computing nodes 1522 (e.g., physical computing machines orvirtualized computing machines) to execute the model-related processthreads. The distributed computation system 1520 can parallelize theexecution of the model-related process threads. The distributedcomputation system 1520 can implement a distributed resource manager(e.g., Apache Hadoop YARN) and a real-time distributed computationengine (e.g., Storm or Spark Streaming) to coordinate its computingnodes 1522 and the model-related process threads running thereon. Thereal-time distributed computation engine can be implemented based on atask parallel architecture. In an alternative embodiment, the real-timedistributed computation engine can be implemented based on adata-parallel architecture.

Each computing node 1522 can implement one or more computation workers(or simply “workers”) 1526. A computation worker is a logical constructof a sandboxed operating environment for process threads to run on. Acomputation worker can be considered a “processing node” of thecomputing cluster of the distributed computation system 1520. In someimplementations, at least one of the computing nodes 1522 implements acluster manager 1528 to supervise the computation workers 1526. Each ofthe computation workers 1526 can execute one or more model-relatedprocess threads. In some implementations, a computation worker 1526 onlyexecutes one type of model-related process thread, where process threadsof that type share the same input data.

V. Model Registry

FIG. 16 is a block diagram illustrating an architectural framework of amachine learning model, in accordance with various embodiments. Amachine learning model 1600 corresponds to a model type 1602. TheML-based CEP engine 1500 can implement multiple machine learning modelsof the same model type. For example, a model type can define a workflowfor entity-specific models to be trained and applied. In this example,the ML-based CEP engine 1500 trains as many models of the model type asthere are known entities. The model type 1602 is defined by a model typedefinition 1700 stored in the model registry 1530. FIG. 17 is a blockdiagram illustrating an example of the model type definition 1700. Themodel type definition 1700 includes various configurations of how amachine learning model is to be trained or applied. The model typedefinition 1700 includes a code reference 1702 to a model execution code1610 in the model execution code base 1534. The model type definition1700 includes a model type identifier 1704, a model type name 1706, aprocessing mode specifier 1708 for the model training workflow, aprocessing mode specifier 1710 for the model deliberation workflow, amodel input type configuration 1712 (e.g., one or more subscriptions toone or more event views as described in this disclosure), a model typetopology 1714, or any combination thereof. A processing mode specifierspecifies a processing mode, such as a real-time processing mode or abatch processing mode.

The model input type configuration 1712 specifies what event views(e.g., described in this disclosure) that the model type 1602 subscribesto. The event feature sets from the unbounded stream 1502 can be labeledwith event view labels corresponding to the event views. The ML-basedCEP engine 1500 can select the event feature sets received from theunbounded stream 1502 based on event view labels of the event featuresets (e.g., selecting only the event feature sets based on the eventview labels corresponding to the event view subscriptions in the modelinput type configuration 1712). The ML-based CEP engine 1500 can calland execute an access interface associated with an event viewsubscription to organize the selected event feature sets and provideformat/bind at least a subset of features within the selected eventfeature sets to a preferred data structure for a model-related processthread. The ML-based CEP engine 1500 can provide (e.g., stream via adata pipeline) the selected and formatted event feature sets to amodel-related process thread of the model type 1602.

The model type topology 1714 specifies how the ML-based CEP engine 1500groups and distributes model-specific process threads to, for example,the different computation workers 1526 in the distributed computationsystem 1520. The model type topology 1714 also specifies how theML-based CEP engine 1500 groups and distribute the input data for themodel-specific process threads of the same model type 1602. In someembodiments, the ML-based CEP engine 1500 groups and divides the inputdata for the model-specific process threads into mutually exclusivepartitions. In other embodiments, the ML-based CEP engine 1500 groupsthe input data for the model-specific process threads into groups thathave at least some overlap. For example, the model type topology 1714can specify an entity type (e.g., a type associated with users, devices,systems, applications, process threads, network resource locators, orany combination thereof). In one specific example, if the model typetopology 1714 specifies users as the entity type, the ML-based CEPengine 1500 groups the selected event feature sets by user groups. Forexample, the ML-based CEP engine 1500 can divide all known user entitiesinto user groups, and divide the selected event feature sets by the usergroup or groups to which each event feature set corresponds.Consequently, the distributed computation system 1520 can assign acomputation worker 1526 to process event feature sets corresponding toeach group/partition.

One or more model states stored in the model store 1532 represent themachine learning model 1600. If the ML-based CEP engine 1500 trains andapplies a single version of the machine learning model 1600, then asingle model state represents the machine learning model 1600. Inembodiments where the ML-based CEP engine 1500 trains multiple versionsof the machine learning model 1600, each model version 1604 correspondsto a different model state stored in the model store 1532. In suchembodiments, a group of model states corresponds to different modelversions representing different training stages of the machine learningmodel 1600. In this case, the group of model versions is part of thesame machine learning model 1600 because these model states are alltrained for a specific entity or a specific purpose. For example, amachine learning model can be a label used to refer to the group ofmodel states that are specifically trained by event feature setscorresponding to a single user and applied to event feature setscorresponding to that single user. Each model state of each modelversion can correspond to a different sequence of event feature setsused to train the model state (herein the different sequences of eventfeature sets correspond to different “training stages”). For anotherexample, a machine learning model can be a label used to refer to thegroup of model states that are specifically trained by a specific typeof anomalies and applied to that type of anomalies.

A model state is the output of a model training process thread 1606. TheML-based CEP engine 1500 instantiates a model deliberation processthread 1608 based on the model state. The model training process thread1606 and the model deliberation process thread 1608 can be referred toas “model-specific process threads.” The ML-based CEP engine 1500 caninstantiate the model-specific process threads in the distributedcomputation system 1520. For simplicity, in parts of this disclosure,“instantiating” a model refers to instantiating the model deliberationprocess thread 1608 for a particular version of a machine learningmodel. Also for simplicity, in parts of this disclosure, “processing”input data “through” a model refers to processing the input data by themodel deliberation process thread 1608 corresponding to the model.

The model execution code 1610 includes model program logic 1612 thatdescribes data structures associated with model-related process threadsand logic of the model-related process threads. The model program logic1612 references model training process logic 1616 and model deliberationprocess logic 1618. The model training process logic 1616 defines howthe model training process thread 1606 is to transform input data (e.g.,one or more event feature sets) into a model state or an update to themodel state. The model state is representative of a machine learningmodel or at least a version of a machine learning model (when there aremultiple versions). As more input data is provided to the model trainingthread, the model training thread can update the model state. The modeldeliberation process logic 1618 defines how input data (e.g., one ormore event feature sets) to a model deliberation process thread,configured by a model state, is to be transformed into security-relatedconclusions.

The model execution code 1610 also includes a model program template1622, a model training program template 1626, and a model deliberationprogram template 1628. These program templates contain process logicsthat are shared amongst all types of machine learning models. Theseprogram templates also impose restrictions such that an author of themodel program logic 1612, the model training process logic 1616, and themodel deliberation process logic 1618 creates consistent process logicsthat can function in the ML-based CEP engine 1500. For example, themodel program template 1622 can impose a restriction that any modelprogram logic, such as the model program logic 1612, has to reference atleast a model training process logic and a model deliberation processlogic.

The architectural framework described in FIG. 16 enables real-timeregistration of a new model type. Real-time registration enables anetwork security administrator to deploy updates to the ML-based CEPengine 1500 or an ML-based batch processing engine without having toshut down the engines or any model-related process threads runningthereon. The program templates and the workflow configurations using themodel type definition 1700 provide a formal way to train and applymachine learning models. The use of the distributed filesystem 1514facilitates persistence of model states while the model-related processthreads are running in a distributed manner.

The ability to label the model version 1604 to a model state in themodel store 1532 enables the ML-based CEP engine 1500 to maintainlineage between training data sets for a machine learning model and themodel states produced therefrom. The versioning of the machine learningmodels enables simultaneous training of different machine learningmodels using the same data to produce model states corresponding todifferent windows of training data sets. The simultaneous training ofthe machine learning models further enables the ML-based CEP engine 1500to “expire” model versions that have been trained with outdated data.

FIG. 18 is a block diagram illustrating a system architecture forimplementing the distributed computation system 1520, in accordance withvarious embodiments. The distributed computation system 1520 implementsa cluster resource manager 1802 (e.g., YARN). The cluster resourcemanager 1802 can function as an operating system for running dataprocessing platform engines. For example, the cluster resource manager1802 can implement a distributed computing platform engine 1804 (e.g., areal-time distributed computation platform, such as Storm or SparkStreaming). The processes running on the distributed computing platformengine 1804 can access various data access systems in a data accesslayer 1806. For example, the data access layer 1806 can provide accessto a relational database, a graph database, a non-relational database, atime series database, the cache component 1512, the distributedfilesystem 1514, or any combination thereof.

The distributed computing platform engine 1804 can implement a modelexecution engine 1808. The model execution engine 1808 can theninitialize one or more model-related process threads 1810 (e.g., a modelpreparation thread, one or more model training threads and/or modeldeliberation threads) managed by the distributed computing platformengine 1804. Each model-related process thread 1810 is a sequence ofprogram instructions related to training, deliberation, or preparationof a machine learning model. Each model-related process thread 1810 canbe managed independently by the distributed computing platform engine1804. For example, method 1900 illustrates a potential workflow of amodel preparation thread; method 2000 illustrates a potential workflowof a model training thread, and method 2100 illustrates a potentialworkflow of a model deliberation thread. The data access layer 1806 canenable the model-related process threads 1810 to access model typedefinitions in the model registry 1530, model states in the model store1532, and event feature sets in the cache component 1512.

FIG. 19 is a flow diagram illustrating a method 1900 to execute a modelpreparation process thread, in accordance with various embodiments. Themodel execution engine 1808 reads the model registry 1530 to determinewhich model types are assigned to the ML-based CEP engine 1500 (e.g., asopposed to an ML-based batch processing engine). The model executionengine 1808 executes the model preparation process thread. This processsimilarly applies to the model execution engine of the ML-based batchprocessing engine. The model execution engine 1808 running on thedistributed computation system 1520 extracts the parameters of eachmodel type definition to configure the workflows of that model type. Themodel execution engine 1808 can instantiate a model preparation processthread in the ML-based CEP engine 1500 for each model type that haseither the processing mode specifier for training 1708 or the processingmode specifier 1710 designating the real-time processing mode. Eachmodel preparation process thread can initiate multiple model-specificprocess threads corresponding to its model type. Accordingly, theML-based CEP engine 1500 can be concurrently training and/ordeliberating multiple machine learning models of different model types.

At step 1902, the model preparation process thread selects a subset ofevent feature sets in the cache component 1512 for the model type. Themodel preparation process thread can select the subset from the mostrecent event feature sets (e.g., a real-time time slice) that are yet tobe processed by the model execution engine 1808 or any other modelpreparation process threads. For example, the model preparation processthread selects and filters the event feature sets based on event viewlabels in the event feature sets. In some embodiments, the modelpreparation process thread can request the subset from the messagingplatform 1518. The model preparation process thread can select thesubset that has event view labels corresponding to event viewsubscriptions in the model type associated with the model preparationprocess thread. The model input type configuration 1712 of the modeltype specifies the event view subscriptions. At step 1904, the modelpreparation process thread can format the selected subset into amodel-type-specific format. A binding process specified by one or moreaccess interfaces (described above in this disclosure) respectivelyassociated with the event view subscriptions can configure themodel-type-specific format. In some embodiments, the formatting includesremoving some feature fields from the selected subset.

At step 1908, the model preparation process thread can assign (e.g.,partition) the formatted subset of event feature sets into data groups(also referred to as “data partitions”) according to the model typetopology 1714 of the model type. The model type can correspond to anentity type (e.g., users, devices, systems, resource locators,applications, process threads, or anomalies) or a purpose type (e.g.,for global beaconing detection). A global purpose-specific model typecan have a single model training process thread and/or a single modeldeliberation process thread. For example, the model preparation processthread can determine the number of known entities of the entity type.The model preparation process thread can partition the event featuresets in the formatted subset into a number of data groups correspondingto the number of available computation workers for the model type. Eachdata group corresponds to the number of entities equal to the totalnumber of known entities divided by the number of data groups.

For example, the model type topology 1714 may specify a user leveltopology. The model preparation process thread can request the totalnumber of users from the target-side computer system. Based on the totalnumber of available computation workers in the distributed computationsystem 1520, the model execution engine 1808 can evenly assigncomputation workers to each model type. Then, the model preparationprocess thread can assign a number of data groups based on the availablecomputation workers for its model type. Each available computationworker can be assigned a data group. For example, there can be fiveavailable computation workers and 20 known users. In this example, themodel preparation process thread can assign a data group correspondingto 4 users to each computation worker. Event feature sets correspondingto these 4 users would be part of the data group.

In some embodiments, the model preparation process thread can perform aconsistent hash on the formatted subset of event-based features. Thedata group assignment can be based on the consistent hash, such asdistributed hash tables (DHTs). Consistent hashing is a kind of hashingsuch that when a hash table is resized and consistent hashing is used,only K/n keys need to be remapped on average, where K is the number ofkeys, and n is the number of slots. In contrast, in most traditionalhash tables, a change in the number of array slots causes nearly allkeys to be remapped. The consistent hashing concept applies to DHTs.DHTs use consistent hashing to partition a keyspace among a distributedset of nodes (e.g., the computation worker corresponding to the datagroup), and additionally provide an overlay network that connects nodessuch that the node responsible for any key can be efficiently located.

Optionally, at step 1910, the model preparation process thread sortseach data group of the formatted subset (e.g., by timestamps of theformatted event feature sets). This step is executed if the order of theformatted event feature sets is part of model training or modeldeliberation. For example, time sequence prediction models, such asprobabilistic suffix trees (PSTs), are trained based on an orderedsequence of event features. The data intake and preparation stage maynot have received raw event data in temporal order from the target-sidecomputer system. The target computer network may not have recorded theraw event data in temporal order. In these cases, step 1910 can ensure,via sorting, that groups of the formatted subsets are in order.

At step 1912, the model preparation process thread instantiates one ormore model-specific process threads to at least a subset of thecomputation workers 1526 according to the model type topology 1714. Insome embodiments, each computation worker runs only model-specificprocess threads of one model type. In some embodiments, each computationruns only model-specific process threads of one model type and eitheronly model training process threads (e.g., corresponding to a modeltraining workflow) or only model deliberation process threads (e.g.,corresponding to a model deliberation workflow). In the ML-based CEPengine 1500, when the processing mode specifier 1708 corresponds to areal-time processing mode, the model preparation process thread canschedule one or more model training process threads to run on the subsetof computation workers 1526. Also in the ML-based CEP engine 1500, whenthe processing mode specifier 1710 corresponds to a real-time processingmode, the model preparation process thread can schedule one or moremodel deliberation process threads to run on the subset of computationworkers 1526. In the ML-based batch processing engine, when theprocessing mode specifier 1708 corresponds to a batch processing mode,the model preparation process thread can schedule one or more modeltraining process threads to run on a subset of computation workers in abatch processing cluster. Also in the ML-based batch processing engine,when the processing mode specifier 1710 corresponds to a batchprocessing mode, the model preparation process thread can schedule oneor more model deliberation process threads to run on a subset ofcomputation workers in the batch processing cluster.

The model preparation process thread can determine, based on the modeltype topology 1714, how many model training process threads of the modeltype to instantiate for the model training workflow and/or how manymodel deliberation process threads for the model deliberation workflow.For example, the model type topology 1714 can correspond to an entitytype (e.g., users, devices, applications, process threads, networkresource locators, systems, anomalies, etc.) and/or a purpose-type. Thenumber of model-specific process threads (e.g., training ordeliberation) can match the number of known entities of the entity type.The model preparation process thread can identify the known entities andinstantiate a model-specific process thread corresponding respectivelyto the known entities. The model preparation process thread can querythe target-side computer system in the target computer network for theidentities and/or the total number of the known entities. In someembodiments, the target-side computer system provides this informationon its own and this information is saved in the cache component 1512 orthe distributed filesystem 1514.

At step 1914, the model preparation process thread generatesgroup-specific data streams to the computation workers of eachmodel-specific process thread instantiated in step 1912. Thegroup-specific data streams correspond to the assigned data groups instep 1908. The model preparation process thread can configure themessaging platform 1518 to send appropriate event feature sets in thedata group through the group-specific data streams. The modelpreparation process thread can execute steps 1912 and 1914 concurrently.

Topology

In several embodiments, the ML-based CEP engine 1500 determines theassignments of the group-specific data streams and the model-specificprocess threads to the computation workers 1526 based on the model typetopology 1714. These assignments can be referred to as topology-basedassignments. The topology-based assignments can be used to optimizemodel-specific process threads regardless of whether the ML-based CEPengine 1500 or an ML-based batch processing engine is used as anexecution platform. Here, the model type topology is decoupled from theexecution platform unlike traditional methodologies. The topology-basedassignments maintain a directed acyclical graph (DAG) structure thatallows for dynamic execution of model-specific process threads andmanagement of the input data dependencies of these model-specificprocess threads. For example, the DAG approach enables model-specificprocess threads to freely move, start, or stop amongst the computationworkers 1526 based on the performance of the machine learning models.The DAG approach further enhances security, scalability (e.g., theability to employ services for caching, the load-balancing, replication,or concentration of data streams), and modularity (e.g., updates to anyparticular model-specific process thread only affect a limited portionof the computation workers 1526). The DAG approach enables processreplication, data redistribution, proxy processes or groups of proxyprocesses, integration of subsystems, and/or redundant connections to beadded in the distributed computation system 1520.

FIG. 20 is a flow diagram illustrating a method 2000 to execute a modeltraining process thread, in accordance with various embodiments. Acomputation worker executes the model training process thread. In someembodiments, the computation worker execute multiple model trainingprocess threads associated with a single model type. In someembodiments, the computation worker executes multiple model-specificprocess threads associated with a single model type. In someembodiments, the computation worker executes multiple model-specificprocess threads associated with different model types. If a model statecorresponding to the model training process thread is not already in themodel store 1532, at step 2002, the model training process threadprocesses a time slice of event feature sets, from the group-specificdata stream described in step 1914 of FIG. 19, to produce a model statein the model store 1532 according to the model training process logic1616. The time slice can correspond to an event or a sequence of eventsobserved at the target computer network. The time slice can be the mostrecent event feature set or sequence of event feature sets. The modeltraining process thread can save the model state in the model store 1532(e.g., in the distributed filesystem 1514 or the cache component 1512).

At step 2004, the model training process thread continuously retrainsthe model state as the group-specific data stream provides additionalevent feature sets. In several embodiments, the model training processlogic 1616 describes a single-pass training process logic. That is, themodel training operates without recursion or iteration over the sameinput data. In some embodiments, the model training process logic 1616involves an incremental training process. For example, the modeltraining process thread isolates a portion of the model state affectedby the time slice of event feature sets and re-trains only the portionof the model state. Model types with incremental property enable theML-based CEP engine 1500 to execute in real-time because of reduction inresource consumption during model training.

At step 2006, the model training process thread calls a model readinesslogic in the model training process logic 1616 to determine when themodel state has sufficient training. The model readiness logic caninclude measuring how many event feature sets have been used to trainthe model state; measuring how long the model state has been in trainingin real-time; whether the model state is converging (i.e., not changingwithin a threshold percentage despite additional training); or anycombination thereof. Different model types can have different modelreadiness logics. At step 2008, when the model readiness logicdetermines that the model state has sufficient training, the modeltraining process thread marks the model state for deployment.

FIG. 21 is a flow diagram illustrating a method 2100 to execute a modeldeliberation process thread, in accordance with various embodiments. Acomputation worker executes the model deliberation process thread. Insome embodiments, the computation worker execute multiple model trainingprocess threads associated with a single model type. In someembodiments, the computation worker execute multiple model-specificprocess threads associated with a single model type. In someembodiments, the computation worker execute multiple model-specificprocess threads associated with different model types. At step 2102, themodel deliberation process thread processes the most recent time slicefrom the group-specific data stream to compute a score associated withthe most recent time slice. The most recent time slice can correspond toan event or a sequence of event observed at the target computer network.In some embodiments, the group-specific data stream used by the modeldeliberation process thread is also used by a corresponding modeltraining process thread for the same entity. That is, the model trainingprocess thread can train a model state of an entity-specific machinelearning model by processing a previous time slice of the group-specificdata stream. The model execution engine 1808 can initiate the modeldeliberation process thread based on the model state while the modeltraining process thread continues to create new versions (e.g., newmodel states). In some embodiments, the model deliberation processthread can reconfigure to an updated model state without pausing orrestarting.

At step 2104, the model deliberation process thread generates asecurity-related conclusion based on the score. The security-relatedconclusion can identify the event or the sequence of eventscorresponding to the time slice as a security-related anomaly, threatindicator or threat. In one example, the model deliberation processcompares the score against a constant threshold and makes thesecurity-related conclusion based on the comparison. In another example,the model deliberation process compares the score against a dynamicallyupdated baseline (e.g., statistical baseline) and makes thesecurity-related conclusion based on the comparison.

At step 2106, the model deliberation process thread aggregates thesecurity-related conclusion into the security-related conclusion store1542. The aggregation of the security-related conclusions can be used inan analytic platform of the ML-based CEP engine 1500. In someembodiments, the security-related conclusion store 1542 is backed up tothe distributed file system 1514. Optionally, at step 2108, the modeldeliberation process thread publishes the security-related conclusion tothe messaging platform 1518, such that another model deliberationprocess thread or model training process thread can utilize thesecurity-related conclusion.

When the security-related conclusion indicates that a potential securitybreach (e.g., a threat or a threat indicator) has occurred, at step2110, the model deliberation process thread can generate a userinterface element to solicit an action command to activate a threatresponse. In one example, the user interface element triggers the actioncommand for sending a message to the target-side computer system todemand termination of a problematic application, blocking of specificnetwork traffic, or removal of a user account. In some embodiments, atstep 2112, the model deliberation process thread can generate a userinterface element to accept feedback from a user to confirm or rejectthe security-related conclusion. The model execution engine 1808 canprovide the feedback to a model training process thread to update themodel state used to configure the model deliberation process thread.

The model deliberation process thread can check, at step 2114, its ownperformance health. For example, the model deliberation process threadcan compare the computed score or the generated security-relatedconclusion against that of other model deliberation process threads todetermine if there are significant deviations or biases. The modeldeliberation process thread can also check to see if there is an unusualbias in its production of security-related conclusions. For example, ifmore than a threshold percentage of its security-related conclusionscorrespond to anomalies or threats, then the model deliberation processthread sets its own health status to failure. Based on the conclusion instep 2114, the model deliberation process thread can decommission itselfat step 2116. In some embodiments, a separate process thread can performsteps 2114 and 2116 by externally monitoring the health status of themodel deliberation process thread.

The method 2100 enables dynamic deployment of a model state. Forexample, the machine learning model associated with the modeldeliberation process thread can have multiple versions. Step 2102 caninitially be configured by a model state corresponding to an activeversion of the machine learning model. However, while the active versionis used to configure the model deliberation process thread, a modeltraining process thread can train another version (e.g., another modelstate) of the machine learning model in parallel. When this otherversion is ready for active deployment (e.g., has sufficient training),the model deliberation process can “live swap” in the other version asthe active version (e.g., to compute the score for subsequent timeslices from the group-specific data stream). Live swapping involvesre-configuring the model deliberation process thread with the othermodel state without terminating the model deliberation process thread.

VI. Batch Processing Path Considerations

In some embodiments, the security platform includes two event processingengines in different paths—a real-time path and a batch path. The eventprocessing engine in the real-time path operates in a real-time mode toprocess unbounded, streaming data that enters the security platform. Theevent processing engine in the batch path operates in a batch mode toprocess batches of stored, historical event data. Because the batchevent processing engine tends to have more time to process data but alsotends to handle a larger amount of data (e.g., stored in HDFS™), it isdesirable for an event processing engine implemented on the batch pathbe able to (1) interact with the distributed data cluster that storesthe data, instead of moving or copying the data into the platform; and(2) utilize various programming models that are optimized for processingand generating large data sets in a parallel, distributed manner on acomputer cluster. One example of such a programming model is MapReduce™.

Therefore, in one aspect, one of the data connectors that can be used bythe security platform 300 introduced here is a specialized connector(e.g., the HDFS™ connector) that can issue instructions (e.g., a query),operations, or otherwise interact with the non-relational database thatstores the data (e.g., HDFS™). In some embodiments, because thedownstream processing may be dependent on the order of the events (e.g.,for building a behavioral baseline for a user or a device), the HDFSconnector can to retrieve the stored event data in the order that theevent takes place.

In another aspect, the machine learning models utilized by the batchevent processing engine can be “reducible,” in order to be compatiblewith parallel, distributed types of operations (e.g., MapReduce™operations). As used herein, a reducible model is a model that can bemapped into multiple copies for processing data. Each copy of the modelonly processes (e.g., for training and/or scoring) a particular subsetof a larger set of data. Then, all the information generated by thecopies of the model can be reduced back to the model, achieving the sameresult as if a single copy of the model has processed the entire dataset. That is, a reducible model can process data in a parallel manner.Note that, depending on the model, some models may be reducible in theirtraining phase but not their scoring phase, some models may be reduciblein their scoring phase but not their training phase, and some models maybe reducible in both training and scoring phases.

Generally, the batch event processing engine introduced here cancooperate with the HDFS™ connector to access data stored in the HDFS™.To achieve this functionality, in some embodiments, the platform caninclude (e.g., in the batch path) a job controller and a directorycatalog. The job controller can function as the batch event processingengine's manager and works with the connector. For example, the jobcontroller can cause the connector to run a query against the HDFSdatabase, and select a set of the returning event data to be processedby the batch event processing engine. The query can, for example,specify a time range, and/or specify that the result should be orderedby event time.

In addition, in some embodiments, certain kinds of log files arepreferably to be processed before others, and the HDFS connector canselect to retrieve those log files that need to be processed first.Typically, data of events that have richer information can be retrievedfirst in order to increase the accuracy of the overall securityanalysis. For example, to enable identity resolution, device resolution,and session tracking, those log files with device information (e.g.,DHCP) are preferably processed first, followed by log files whichassociate user data with devices (e.g., AD or VPN), followed by allother files. Additionally or alternatively, the query that is sent bythe connector can specify that the retrieved files (e.g., representingevents) should be ordered by their formats (e.g., DHCP, then AD/VPN,then others).

In response to the retrieved data, the job controller then launches ajob for the batch event processing engine (e.g., in Spark™) with theretrieved files, tracks the analysis progress, and marks the events asanalysis completed or analysis failed. Once the analysis is completed,then the job controller can perform other tasks, such as exporting theresult of identity resolution (e.g., into Redis™), exporting thetime-series data (e.g., into OpenTSDB™), or pushing the anomalies raisedby the batch event processing engine into a messaging system (e.g.,Kafka™).

The job controller can start the aforementioned file retrieval processbased on a time schedule. For example, the file retrieval process can beset to run every hour, every N hours, every N days, and so forth. Afterthe connector retrieves the files, the batch of files is passed to thejob controller, which in turn initiates the batch event processingengine to analyze the files.

The directory catalog is a database (e.g., coupled to the HDFS) thatenables the job controller (working with the connector) to determinewhich files to parse and the order in which the files get parsed. Thefollowing is a specific example of how a specialized connector (e.g.,the HDFS connector) introduced here can interact with a distributeddatabase storage system (e.g., HDFS™) to retrieve files. In thisexample, the connector can determine a time for the first event in afile in the HDFS. The file records a number of events. The time for thefirst event can be used by the job controller to determine whether itshould retrieve this file and process it for anomaly/threat detection.

When the connector (e.g., HDFS connector) is activated to retrieve filesof a particular time range (e.g., each file representing a number ofevents that take place within the particular time range), the connectorfirst refers to a table in the database (“directoryCatalog”) to check ifthere is any row in the table (e.g., indicating a file) that still needsto process (e.g., which may be a leftover from a previous run). Theconnector also stores the last time it was run in the database(“lastRunTime”).

If the connector does not find any files in the directoryCatalog, thenthe connector crawls the currently specified directory (that correspondsto the particular time range), to see if there is any file to process.When the connector encounters a file, the connector retrieves amodification time (“mtime”) of the file, and discards the file if thefile is earlier than the lastRunTime. Otherwise, the connector parsesthe file to get the time of the first event from the file. In oneexample, the connector can parse the file with a parser that correspondsto the file's data format, and extract only the time from the event. Inthis manner, the connector can continue to process a few select eventsin the file and determine if the events are recorded in the file in anascending order (or in any order).

Thereafter, if the connector determines that the events are recorded inan ascending order (within a tolerance of a few seconds), then theconnector can stop parsing and return the time of the first event.Conversely, if the events are stored in a descending order, theconnector then seeks toward (e.g., to a few kilobytes short of) the endof the file and retrieves the time of the first event from there. In thecase that the connector determines that the events are recorded in anunsorted manner, the connector parses the entire file and returns thelowest time found as the event time of the first event recorded in thefile. Then, the connector adds an entry in the database with thefilename, time of the first event and other status (e.g., retrieved).

The batch event processing engine can perform analysis based oninformation that is not available in the real-time path. An example ofsuch information is the composite relationship graph (which is describedin greater detail in a section below). Accordingly, the batch eventprocessing engine can process a projection (portion) of the compositegraph in utilizing some of the machine learning models.

In some embodiments, the batch event processing engine can first locatethe composite relationship graph that is associated with the historicevent data. Then, based on the requirement of a particular machinelearning model, the batch event processing engine can obtain aprojection of the composite relationship graph. The compositerelationship graph can include information from the data intake andpreparation stage (e.g., per-event relationship graph) and informationgenerated by the real-time event processing engine processing theunbounded stream of event data (e.g., detected anomalies, which can beadded to the per-event relationship graph of the anomalous event).

In some examples, a projection of the composite relationship graphincludes a graph of users associated with machines, to facilitatetracking (by the particular machine learning model) of user lateralmovement. In some examples, the projection includes a graph thatassociates entities identified as having security-related issues tofacilitate correlating (by the particular machine learning model) useranomalies so as to identify sophisticated threats. In some examples, theprojection includes a graph of website visitation activities of users tofacilitate identification (by the particular machine learning model) ofcommonly accessed websites by potentially security-compromised users.More details on the models that can utilize projections of the compositerelationship graph are discussed below with respect to anomaly andthreat models.

VII. Model State Sharing

As discussed above, one of the features of the security platformintroduced here is the capability to share information between differentanalytics entities (including, for example, an event processing enginesuch as the CEP engine). Information or knowledge sharing in this mannercan be especially useful in detecting unknown security-related anomaliesand threats.

Among other reasons, the big-data based, highly modularizedcharacteristics of the security platform architecture introduced herepresent many opportunities for different components to benefit fromintelligence sharing. For example, in certain implementations, asmentioned above, the security platform can include at least two eventprocessing engines—one event processing engine operating in a real-timemode to process unbounded, streaming data that enters the securityplatform, and the other event processing engine operating in a batchmode to process batches of historical event data. In another example, asecurity platform deployed in an environment (e.g., an organization oran enterprise) may communicate with another security platform deployedin a different environment. All these event processing engines, becauseof their different operating modes, different data input, and/ordifferent deployed environment, can potentially benefit from theknowledge gained by each another.

Thus, with the aforementioned discussion regarding the CEP engine'sfunctionalities in mind, introduced here is a particular way toconfigure the security platform to further enhance anomaly and threatdetection. Specifically, the security platform's architecture isconfigured so that the model store (which stores one or more groups ofmodel states, each group corresponding to versions of an entity-specificor purpose-specific machine learning model) that is used in the securityplatform can be shared. As used herein, the phrase “sharing a modelstate” means more than one engine sharing the same version of a model.This notion should be distinguished from the notion of “sharing a modeltype,” which implies that more than one engine can share the modelregistry (which stores the model type) in the security platform. Sharinga model type can enable two engines to use or produce machine learningmodels that have the same model execution logic (e.g., training logicand/or deliberation logic) for different purposes. The general notion of“sharing a model” can be referring to either or both of these notions,whichever is made apparent by the context.

By allowing different engines to access the model store in the securityplatform, this configuration enables the real-time event processingengine and the batch event processing engine to share a model state of aparticular machine learning model. Then, for example, a first engine canfirst use a particular machine learning model to process a first set ofdata to produce a score for detecting a network security-related issue,and in doing so, the particular model is trained by the first enginewith the first set of data, thereby creating a model state reflecting aversion of such model. Thereafter, a second engine uses the sameparticular machine learning model to process a second set of data forproducing a score for detecting a network security-related issue. Withthe model state sharing, the second engine can use the version of themodel that has been trained by the first engine to process the secondset of data, thereby leveraging the knowledge gained by the first engineto discover a security-related issue in the second set of data. Notethat, in certain embodiments, this model state sharing is non-blocking,meaning that a model state can be read and/or updated by any engine atany time.

FIG. 22 shows of an example architecture 2200 of the security platform,in which the model state sharing technique introduced here may beimplemented. As shown, the security platform can be implemented by usingvarious components in a big data oriented software framework, such asHadoop™. The framework enables the components in the platform to be ableto communicate with each other. As shown in FIG. 22, the examplesecurity platform includes a real-time event processing engineimplemented on a first processing system of the platform. In theillustrated example, this first processing system is implemented usingApache Storm™. In other embodiments, the first processing system couldbe implemented by using Apache Spark Streaming. The real-time eventprocessing engine is configured to process an unbounded stream of eventdata to detect a plurality of network security-related issues. In amanner described above, the real-time event processing engine canutilize various machine learning models to perform anomaly and threatdetection. In doing so, the real-time event processing engine trains themachine learning models, and in some embodiments, establishes behavioralbaselines for various specific entities.

Similar to the real-time event processing engine, the example securityplatform includes a batch event processing engine on a second processingsystem of the platform. In the illustrated example, this firstprocessing system is implemented using Apache Spark™. The batch eventprocessing engine is configured to process a batch of historic eventdata to detect a plurality of network security-related issues. Like thereal-time event processing engine, the real-time event processing enginecan also utilize machine learning models, establish behavioralbaselines, and so forth.

In accordance with some embodiments, the security platform can beconfigured to enable sharing of model states between the real-timeprocessing engine and the batch processing engine for network securityanomaly and threat detection. As described above with respect to the CEPengine and the machine learning models, a particular machine learningmodel can be configured to process a time slice of data to produce ascore for detecting a network security-related issue, and with modelstate sharing, the size of the time slice can be controlled by whicheverevent processing engine currently utilizes the particular machinelearning model. For example, if the real-time processing engine isutilizing the model, then the time slice can be set by the real-timeprocessing engine to real-time (e.g., event-by-event as the data streamsinto the platform). Similarly, if the batch processing engine isutilizing the model, the time slice can be set by the batch processingengine to whichever time period length is suitable for grouping thehistoric events (i.e., events that are already stored as opposed tobeing currently streamed) into batches for processing.

In this way, the shared model state can form a positive intelligencefeedback loop between the two engines. From the batch event processingengine's perspective, this loop enables the batch event processingengine to use knowledge gained by the real-time event processing engineto discover a security-related issue in the historic event data that isundetectable by the batch event processing engine without the knowledge.More specifically, the shared model state enables the batch eventprocessing engine to use new knowledge gained by the real-time eventprocessing engine from processing the unbounded stream of event data, toinspect the historic event data to discover a security-related issuethat would be undetectable by the batch event processing engine withoutthat new knowledge. The new knowledge is knowledge gained after the lasttime the batch event processing engine performs historic event datainspection using the particular machine learning model, and therefore itis valuable because the batch event processing engine would not havethis new knowledge but for the model state sharing.

Further, after the batch event processing engine performs an analysis onthe historic event data to detect a security-related issue, the analysismay result in acquisition of new knowledge of event data. For thebenefit of the real-time event processing engine, the batch eventprocessing engine can update the shared model state of the particularmachine learning model to incorporate the new knowledge. In this way, byusing the shared model state, the real-time event processing engine canperform an inspection of newly streamed event data based on this newknowledge gained by the batch event processing engine.

The behavioral baseline establishment technique described above (seediscussion of UBA/UEBA) can also be integrated with the model statesharing technique here. That is, in addition or as an alternative tosharing model states, a behavioral baseline established by one engine(e.g., the real-time event processing engine) by using a particularmachine learning model can be shared along with the model state withanother engine (e.g., the batch event processing engine). With both themodel state and the behavioral baseline established, one engine can takefuller advantage of the knowledge gained by another engine. In oneexample, a particular machine learning model is trained by the real-timeevent processing engine, and a behavioral baseline is established for aspecific entity, also by the real-time event processing engine.Utilizing the techniques introduced here, the batch event processingengine can locate, in the batch of historic event data, datarepresenting a plurality of events that are associated with the specificentity. Then, the batch event processing engine can perform a behavioralanalysis of the entity to detect a behavioral anomaly using the sameversion of machine learning model that has been trained by the real-timeevent processing engine to compute a degree of behavioral deviation, ascompared to the behavioral baseline specific to the entity.

Note that the behavioral anomaly analysis is not limited in applicationto comparing a specific entity with its past behavioral baseline; it canalso include comparing a specific entity's behavior against the behaviorof other similar entities. In other words, other similar entities'behaviors can be used for establishing a behavioral baseline for aspecific entity. Therefore, the combination of the behavioral baselineestablishment technique and the model state sharing technique can beparticularly useful to detect a specific entity's anomalous behaviorwhen historical data of that specific entity is not available (e.g., anew employee joins the enterprise).

In addition, the mechanism of sharing the model state also enables, atleast indirectly, updating a machine learning model based on the userfeedback when the security platform receives such user feedbackregarding a determination of a detected security-related issue. Forexample, such an update can be performed by one of the engines to themodel state, and through the shared model state, the effect of thatfeedback can be propagated into the other engine's anomaly and threatdetection processes.

VIII. Anomalies, Threat Indicators, and Threats

As mentioned above, the security platform 300 detects anomalies in eventdata, and further detects threats based on detected anomalies. In someembodiments, the security platform also defines and detects anadditional type of indicator of potential security breach, called threatindicators. Threat indicators are an intermediary level of potentialsecurity breach indicator defined within a hierarchy of security breachindicators that includes anomalies at the bottom level, threatindicators as an intermediate level, and threats at the top level.

FIG. 23 is flow diagram illustrating at a high level, a processinghierarchy 2300 of detecting anomalies, identifying threat indicators,and identifying threats with the security platform 300. Reducing falsepositives in identifying security threats to the network is one goal ofthe security platform. To this end, flow diagram describes an overallprocess 2300 by which large amounts of incoming event data 2302 areprocessed to detect anomalies. The resulting anomaly data 2304comprising a plurality of anomalies across a computer network is thenfurther processed to identify threat indicators. This identification ofthreat indicators can be conceptualized as an intermediate step betweendetecting anomalies and identifying security threats to a computernetwork. As shown, the threat indicator data 2306 comprising a pluralityof threat indicators identified across a computer network is furtherprocessed to identify a security threat or threats.

As discussed above, an anomaly represents a detected variation from anexpected pattern of behavior on the part of an entity, which variationmay or may not constitute a threat. An anomaly represents an event ofpossible concern and possibly may be actionable or warrant furtherinvestigation. A detected anomaly in the activity on a computer networkis often associated with one or more entities of the computer network,such as one or more physical computing devices, virtual computingdevices, users, software modules, accounts, identifiers, and/oraddresses. An anomaly or a set of anomalies may be evaluated (e.g.scored) together, which evaluation may result in a determination of athreat indicator or a threat. Threat indicators represent an escalationof events of concern and are evaluated to identify if a threat to thesecurity of the network exists. As an example of scale, hundreds ofmillions of packets of incoming event data from various data sources maybe processed to yield 100 anomalies, which may be further processed toyield 10 threat indicators, which may again be further processed toyield one or two threats.

FIG. 24 is flow diagram illustrating in more detail an example process2400 for detecting anomalies, identifying threat indicators, andidentifying threats to network security. The process begins by detectinganomalies in activity on a computer network, based on received eventdata. As shown in FIG. 24 at step 2402, incoming event data 2302 isprocessed through a plurality of anomaly models 1 through N, which maybe machine learning models as discussed above, and which at step 2404may output anomaly data 2304 indicative of a plurality of anomalies 1through M. As shown in FIG. 24, an anomaly is not necessarily detectedfor a given set of event data 2302. For example, as shown at step 2406,when the event data 2302 is processed by anomaly model N, no anomaly isdetected.

The process continues with generating anomaly data 2304 indicative ofthe anomalies in response to the detection. The anomaly data 2304, asused herein, generally refers to the entire set or a subset of thedetected anomalies across the computer network. For example, asrepresented in FIG. 24, the processing of event data 2302 according tothe plurality of models at step 2402 leads to the outputting ofanomalies (or associated data) 1 through M at step 2404. In someembodiments, the anomaly data 2304 includes only the event data 2302associated with detected anomalies. In other words, the anomalyprocessing can be viewed as a filtering process to pass on only eventdata associated with anomalous activity. In other embodiments and asexplained elsewhere in this specification, the anomaly data 2404includes data in addition to the underlying event data 2302. Forexample, the anomaly data associated with a particular entity mayinclude the underlying event data associated with the anomalousactivity, annotated information about that entity (e.g. a user ID oraccount associated with a device), timing data associated with theanomalous activity (e.g. when the anomaly occurred, when a similaranomaly last occurred, or periodicity of this type of anomaly showing upfor the particular entity), etc. In some embodiments, the anomaly data2304 is stored in a data structure in the form of an anomaly graph. Insuch embodiments, the anomaly graph includes a plurality of vertices(nodes) representing entities associated with the computer network and aplurality of edges, each of the plurality of edges representing ananomaly linking two of the plurality of vertices (nodes).

The process continues with identifying threat indicators by processingthe anomaly data. As shown in FIG. 24, at step 2408 the anomaly data2304 (or at least a subset of anomaly data 2304) is processed through aplurality of threat indicator models 1 through Y, which at step 2410 mayoutput threat indicator data 2306 including a plurality of threatindicators. In an embodiment, the processing of event data 2302 at step2402 to produce anomaly data 2304 occurs on a per entity basis, whilethe processing of anomaly data 2304 at step 2408 can occur across thecomputer network whose security is being monitored, or at least asubgroup of the computer network. In other words, each anomaly 1 throughM is detected as anomalous for a particular entity given event dataassociated with the given entity. While useful, this evaluation isperformed without reference to other activity on the computer network.At step 2408, however, the plurality of threat indicator models 1through Y are evaluating the plurality of anomalies 1 through M thatoccur across the computer network being monitored, not just for aparticular entity. As shown in FIG. 24, a threat indicator is notnecessarily identified based on a given set of anomaly data 2304. Forexample, as shown at step 2412, when the anomaly data 2304 is processedaccording to threat indicator model Y, no threat indicator isidentified.

The process continues with generating threat indicator data 2306indicative of the threat indicators in response to the identifying thethreat indicators. Again, as with the anomaly data 2304, the threatindicator data 2306, as used herein, generally refers to the entire setor a subset of the identified threat indicators across the computernetwork being monitored. For example, as represented in FIG. 24, theprocessing of anomaly data 2304 according to the plurality of threatindicator models at step 2408 leads to the outputting of threatindicators (or associated data) 1 through X at step 2410. In someembodiments, the threat indicator data 2306 simply includes only theevent data 2302 associated with identified threat indicators. In otherwords, the threat indicator processing can be viewed as a furtherfiltering of the event data 2302 to pass on only event data 2302associated with threat indicators. In other embodiments and as explainedelsewhere in this specification, the threat indicator data 2306 includesdata beyond the underlying event data 2302. For example, the threatindicator data 2306 may include the underlying event data associatedwith the anomalous activity, annotated information about the entities(e.g. users, devices, etc.) associated with the threat indicator, timingdata associated with the threat indicator (e.g. when the threatindicator was raised, when a similar threat indicator last occurred,periodicity of this type of threat indicator, etc.). In some embodimentsthe threat indicator data 2306 is stored in a data structure in the formof a threat indicator graph. In such embodiments, the threat indicatorgraph may include a plurality of vertices (nodes) representing entitiesassociated with the computer network and a plurality of edges, each ofthe plurality of edges representing a threat indicator linking two ofthe plurality of vertices (nodes). In other embodiments, the threatindicator data 2306 is instead stored in a relational database or akey-store database.

In some embodiments, the threat indicator data 2306 is incorporated intoa network security graph, which may be the composite relationship graphdiscussed above. The network security graph can include a plurality ofvertices (nodes) representing entities associated with the computernetwork and a plurality of edges linking two or more of the plurality ofvertices (nodes). Each edge in such a graph represents an associationbetween the entities represented by the vertices (nodes). Accordingly,anomalies defined in the anomaly data 2304, and/or threat indicatorsdefined in the threat indicator data 2306, can be incorporated into thegraph as vertices (nodes), each linked to one or more of the entities byone or more edges. For example consider an example in which a threatindicator is identified and is associated with a user 1 using a device 1operating on a computer network. In a highly simplified network securitygraph, the user and device are each defined as a node with an edgelinking them to represent the association (i.e. user 1 uses device 1).An anomaly or a threat indicator is then incorporated as a third nodeinto the simplified graph with edges linking to both the noderepresenting user 1 and the node representing device 1.

The process continues with at step 2414 with identifying threats to thesecurity of the computer network by processing the threat indicator data2306.

A. Detecting Anomalies

FIG. 25 is a flow diagram describing an example process 2500 fordetecting anomalies. Process 2500 begins at step 2502 with receivingevent data 2302 indicative of activity by a particular entity associatedwith a computer network. As described in more detail herein, in someembodiments, event data 2302 is received by a security platform from aplurality of entities associated with the computer network via an ETLpipeline.

Process 2500 continues at step 2504 with processing the event data 2302through an anomaly model. According to an embodiment, an anomaly modelincludes at least model processing logic defining a process forassigning an anomaly score to the event data 2302 and a model statedefining a set of parameters for applying the model processing logic. Aplurality of anomaly models instances may be instantiated for eachentity associated with the computer network. Each model instance may beof a particular model type configured to detect a particular category ofanomalies based on incoming event data. For example, in an embodiment, acomputer on computer network is associated with various anomaly models,with one of the anomaly models configured to detect an anomalyindicative of a machine generated beacon communication to an entityoutside the computer network. According to some embodiments, thesecurity platform includes anomaly models configured to detect a numberof different kinds of anomalous activity, such as lateral movement,blacklisted entities, malware communications, rare events, and beaconactivity. Each of these anomaly models would include unique processinglogic and parameters for applying the processing logic. Similarly, eachmodel instance (i.e. for a particular entity) may include uniqueprocessing logic and parameters for applying the processing logic. Insome embodiments, processing of event data 2302 is performed inreal-time as the event data is received. In such an embodiment,real-time processing may be performed by a processing engine optimizedfor high rate or real-time processing, such as Apache Storm or ApacheSpark Streaming.

Process 2500 continues at step 2506 with assigning an anomaly scorebased on the processing of the event data 2302 through the anomalymodel. Calculation of the anomaly score is done by the processing logiccontained within the anomaly model and represents a quantification of adegree to which the processed event data is associated with anomalousactivity on the network. In some embodiments, the anomaly score is avalue in a specified range. For example, the resulting anomaly score maybe a value between 0 and 10, with 0 being the least anomalous and 10being the most anomalous.

Process 2500 continues at step 2508 with outputting an indicator of aparticular anomaly if the anomaly score satisfies a specified criterion(e.g., exceeds a threshold). Continuing with the given example, thespecified criterion may be set such that an anomaly is detected if theanomaly score is 6 or above, for example. The specified criterion neednot be static, however. In some embodiments, the criterion (e.g.,threshold) is dynamic and changes based on situational factors. Thesituational factors may include volume of event data, presence orabsence of pre-conditional events, user configurations, and volume ofdetected anomalies.

B. Identifying Threat Indicators—Generally

FIG. 26 is a flow diagram describing an example process 2600 foridentifying threat indicators. Process 2600 begins at step 2602 withprocessing the anomaly data 2304 through a threat indicator model, whichlike the anomaly models may also be a machine learning model. As withthe previously described anomaly models, according to some embodiments,a threat indicator model includes model processing logic defining aprocess for assigning a threat indicator score based on processing theanomaly data 2304 and a model state defining a set of parameters forapplying the model processing logic. Specific use cases for identifyingthreat indicators based on detected anomalies are discussed in moredetail herein. In each described use case the steps to identifying athreat indicator may be incorporated into the processing logic. In someembodiments, processing of the anomaly data 2304 may include aggregatinganomaly data across the computer network, correlating differentanomalies within the anomaly data, and/or enhancing the anomaly datathrough enrichment using external data sources. In some embodiments,processing of anomaly data 2304 is performed in real-time as the eventdata is received and anomalies are generated. In such an embodiment,real-time processing may be performed by a processing engine optimizedfor high rate or real-time processing, for example, Apache Storm orApache Spark Streaming. In some embodiments, processing of anomaly data2304 is instead or additionally performed in batch mode. In such anembodiment, batch mode processing may be performed by a processingengine optimized high volumes of data, such as Apache Spark on a Hadoopdistributed computing cluster.

Process 2600 continues at step 2604 with assigning a threat indicatorscore based on processing the anomaly data 2304. As with the anomalymodels, in some embodiments, calculation of the threat indicator scoreis based on the processing logic contained within the threat indicatormodel and represents a quantification of a degree to which the processedanomaly data is associated with activity that may be a threat to thesecurity of the network. As previously described, a threat indicator canbe conceptualized as an escalation or intermediate step betweendetection of an anomaly and identification of a threat to networksecurity. In some embodiments, the threat indicator score is a value ina specified range. For example, the resulting threat indicator score maybe a value between 0 and 10, with 0 being the least threating and 10being the most threatening.

Process 2600 continues at step 2606 with identifying a threat indicatorif the threat indicator score satisfies a specified criterion (e.g., athreshold). Continuing with the given example, the specified criterionmay be set such that a threat indicator is identified if the threatindicator score is 6 or above, for example. The specified criterion neednot be static, however. In some embodiments, the criterion (e.g.,threshold) is dynamic and changes based on situational factors. Thesituational factors may include volume of event data, presence orabsence of pre-conditional events, user configurations, and volume ofdetected anomalies.

C. Identifying Threat Indicators—Entity Associations

As described previously, a detected anomaly is typically associated withone or more entities associated with a computer network. For example, ifan anomaly is detected that is suggestive of beacon activity (discussedfurther below), that beacon activity is typically from one or moredevices operating within the network being monitored. Each of thosedevices may be associated with one or more users. In this particular usecase, the threat indicator models, such as those described previouslywith respect to FIG. 26, are configured to analyze the relationshipsbetween entities on the computer network and the detected anomaliesmaking up the set of anomaly data 2304 across the computer network.

FIG. 27 illustrates a use case for identifying threat indicators basedon entity associations with detected anomalies. The use case illustratedin FIG. 27 is identifying a threat indicator if, based on processing theanomaly data, it is determined that a high number of entities areassociated with a particular anomaly or a particular category ofanomaly.

A shown in FIG. 27, a number of detected anomalies 1 though M areincluded in anomaly data 2304, which is surrounded by the larger dottedline box. Associated with these detected anomalies are various entitiesincluding devices 1 though S and users 1 through R. In this example,anomaly 1 is shown to be associated with at least seven unique entities,including users 1 through R, and devices 1 through S. Anomalies 2, 3,and M, however, are each associated with just one entity, user 3,device, 1, and user R (respectively). This use case assumes that acorrelation among anomalies and entities that establishes relativelyhigh interrelationship is more suspicious than individual occurrences ofanomalous activity. In other words, if a detected anomaly is associatedwith a high number of entities (e.g. users and/or devices) on a computernetwork, that anomaly may be more indicative of threating activity.Accordingly, anomaly 1, surrounded by the smaller dotted line box, maybe identified as a threat indicator based on the processing of anomalydata 2304. It is important to note here that this type of system wideview of anomalous activity is not possible at the anomaly detectionlevel, according to some embodiments, because the anomaly modelinstances are set up to process event data on a per-entity basis. Inother words, an anomaly model is only concerned with what is occurringat a particular entity, while a threat indicator model is concerned withwhat is occurring across the entire computer system.

Anomaly 1 is shown in FIG. 27 as a single anomaly for clarity purposes,however it may also represent a cluster of anomalies that are somehowrelated to one another. In one embodiment, anomaly 1, as shown in FIG.27, may represent a set of anomalies of a particular category ofanomaly. For example, a threat indicator may be identified if a highnumber of entities within a computer network are associated with beaconactivity. That beacon activity may be associated with hundreds orthousands of detected anomalies across the network. In anotherembodiment, anomaly 1, as shown in FIG. 27, may represent a cluster ofanomalies of not just the same category, but substantially matching on alower level as well. For example, beacon activity broadly describes awide range of behavior. However, analysis at a lower level can uncoversimilarities among certain types of beaconing. For example, beaconcommunications known to be associated with malware command and controlcommunications may exhibit similar characteristics. Thesecharacteristics may be described in profile or footprint associated witha particular anomaly. This profile or footprint is based on theunderlying event data 2302 that gave rise to the anomaly. For example,while individually unique, a set of anomalies based on beaconcommunications may exhibit patterns related to destination entities,periodicity of communications, etc. Accordingly, anomaly 1, as shown inFIG. 27 may represent a plurality of individual anomalies that, althoughunique, all have substantially matching profiles or footprints.

In some embodiments, the use case described in FIG. 27 involves aprocess that begins with determining a measure (e.g., a count) ofentities of the computer network associated with a particular anomaly, aparticular category of anomaly, or a set of anomalies with substantiallymatching profiles or footprints. In some embodiments, this determinationis based on an absolute number tracked from when monitoring of thecomputer network commenced. In other embodiments, this determination maybe over a pre-determined and/or dynamic time period.

The process continues with identifying a threat indicator if the measureof entities associated with the particular anomaly, particular categoryof anomaly, or a set of anomalies with substantially matching profilesor footprints, satisfies a specified criterion. The specified criterionmay simply be a threshold number of entities associated with an anomaly.For example, identifying a threat indicator if 20 entities areassociated with a beacon related anomaly. This threshold value need notbe static however. The threshold value may depend on the type of anomalydetected, the types of entities associated (e.g. mission criticalsystems vs. non-critical systems), the temporal clustering of entitiesassociated with the anomaly, etc. In the context of a threat indicatormodel as described with respect to FIG. 26, a threat indicator score canbe assigned based on the processing of the anomaly data with a threatindicator being identified if the threat indicator score satisfies aspecified criterion. For example, the 20 entities associated with aparticular anomaly may lead to assigning an threat indicator score of 6on a scale of 1 to 10. Accordingly a threat indicator is identifiedbecause the assigned threat indicator score is at least 6.

FIG. 28 illustrates a second use case for identifying threat indicatorsbased on entity associations with detected anomalies. The use caseillustrated in FIG. 28 is identifying a threat indicator if, based onprocessing the anomaly data, it is determined that a high number ofanomalies are associated with a particular entity.

As shown in FIG. 28, a number of detected anomalies 1 though M areincluded in anomaly data 2304, which is surrounded by the larger dottedline box. Associated with these detected anomalies are various entitiesincluding devices 1 though S and users 1 through R. Here, user 1 isshown to be associated with at least four anomalies 1 though M (asindicated by the first of two smaller dotted line boxes), and device 1is shown to be associated with least four anomalies 1 though M (asindicated by the second of two smaller dotted line boxes). As with theuse case described with respect to FIG. 27, this use case assumes that acorrelation among anomalies and entities that establishes relativelyhigh interrelationship is more suspicious than individual occurrences ofanomalous activity. In other words, an entity (such as a user or device)that is associated with a high number of detected anomalies may be moreindicative of threating activity. Accordingly, two threat indicators areidentified based on the anomaly data 2304 shown in FIG. 28, one threatindicator based on the anomalies associated with user 1 and one threatindicator based on the anomalies associated with device 1.

As described with respect to FIG. 27, each anomaly 1 through M shown inFIG. 28 is shown as a single anomaly for clarity purposes. However, eachanomaly shown in FIG. 28 may also represent a cluster of anomalies thatare somehow related to one another. For example, anomaly 1 may representa single instance of an anomaly, multiple anomalies of the samecategory, or multiple anomalies with substantially matching profiles orfootprints.

In some embodiments, the use case described in FIG. 28 involves aprocess that begins with determining a measure (e.g. a count) ofanomalies associated with a particular entity of the computer network.In some embodiments, this determination is based on an absolute numbertracked from when monitoring of the computer network commenced. In otherembodiments, this determination may be over a pre-determined and/ordynamic time period.

The process continues with identifying a threat indicator if the measureof anomalies associated with the particular entity satisfies a specifiedcriterion.

In an embodiment, the specified criterion may simply be a thresholdnumber of anomalies associated with a particular entity. For example,identifying a threat indicator if 20 beacon anomalies are associatedwith particular user device on the network. This threshold value neednot be static, however. The threshold value may depend on the type ofanomaly detected, the types of entity associated with the anomalies(e.g. mission critical systems vs. non-critical systems), the temporalclustering of anomalies associated with a particular entity, etc. In thecontext of a threat indicator model as described with respect to FIG.26, a threat indicator score can be assigned based on the processing ofthe anomaly data 2304 with a threat indicator being identified if thethreat indicator score satisfies a specified criterion. For example, the20 anomalies associated with a particular entity may lead to assigningan threat indicator score of 6 on a scale of 1 to 10. Accordingly athreat indicator is identified because the assigned threat indicatorscore is at least 6.

D. Identifying Threat Indicators—Anomaly Duration

FIG. 29 illustrates a use case for identifying threat indicators basedon duration of detected anomalous behavior. Anomalies may be detectedover a period of time, for example, as shown in FIG. 29, anomalies 1through M are detected at time periods t1 through tm. This use caseassumes that a temporal correlation among detected anomalies isindicative of suspicious activity. For example, a high number ofanomalies occurring in a short time period may be indicative of aconcentrated threat to the security of the network.

In some embodiments, the use case described in FIG. 29 involves aprocess that begins with monitoring a duration of a particular anomalyover a time period. Although anomalies 1 through M shown in FIG. 29 areshown as discrete events, in some cases an anomaly may have durationwith a starting time and an end time. The process continues withidentifying a threat indicator if the monitored duration of the anomalysatisfies a specified criterion.

In some embodiments, the use case described in FIG. 29 involves aprocess that begins with determining a number of anomalies that havesubstantially matching profiles or footprints (e.g. as described in theprevious use case) over a time period. These substantially matchinganomalies may indicate a pattern of anomalous activity that hasduration. The process continues with identifying a threat indicator ifthe number of anomalies with substantially matching profiles satisfy aspecified criterion.

E. Identifying Threat Indicators—Local Vs. Global Rarity Analysis

FIG. 30 illustrates a use case for identifying threat indicators basedon local and global rarity analysis. As described elsewhere in thisspecification, in some embodiments, anomalies are detected based on ararity analysis. In other words, if an event satisfies a rarity analysis(i.e. is determined to be rare), it is detected as an anomaly. Thisanomaly detection based on rarity analysis is local rarity analysis,because it looks at the rarity of the event in the context of aparticular entity. In this use case the anomalies detected based onlocal rarity analysis are analyzed across the computer network accordingto a global rarity analysis. In some cases the number of similaranomalies is important indicator of their severity. For example, amachine generated beacon anomaly may be interpreted as malicious ifoccurring in only a small number of systems (intruders of malwareinfections typically affect only a small number of systems,sophisticated attackers will infect a single device).

As shown in FIG. 30, event data 2302 is processed through a number oflocal rarity analysis models 1 through U that are associated withentities 1 through V. The detected anomalies 1 through M are thenanalyzed according to a global rarity analysis model to identify athreat indicator. In some embodiments, the use case described in FIG. 30involves a process that begins with performing a global rarity analysisacross the anomaly data 2304 (or a subset of the anomaly data 2304) overa time period, with the anomaly data 2304 based on anomalies detectedusing local rarity analysis. The process continues with identifying athreat indicator if a pattern in the detected anomalies satisfies aglobal rarity criterion. In some embodiments a global rarity model is amodel that applies the same processing logic as a local rarity model,except that it is applied to the set of anomalies across the networkbeing monitored instead of the event data pertaining to a single entity.

Detection of anomalies by using rarity analysis is discussed in greaterdetail in a section below.

F. Identifying Threat Indicators—Combining Anomalies

FIGS. 31A-31B illustrate a use case for identifying threat indicatorsbased on combining the outputs (i.e. detected anomalies) from differentanomaly models. As described elsewhere in this specification, in someembodiments, different types of anomalies are detected based a differentmodels. In such cases, it may be beneficial to correlate the anomaliesdetected using different model types. For example, a machine generatedbeacon anomaly (detected by a beacon detection model) provides moreinsight if the destination of the beacon is rare for the environment(detected with a rarity analysis model).

As shown in FIG. 31A, a threat indicator is identified by processing theanomaly data 2304 according to a threat indicator model if anomalies 1and 2 are present. For example, two types of beacon activity may beconsidered to be more suspicious when observed in combination. However,as shown in FIG. 31B, if anomaly 2 is not detected (and therefore notpart of anomaly data 2304), the threat indicator is not identified basedon processing according to the threat indicator model.

In some embodiments, the use case described in FIGS. 31A-31B involvescombining anomaly data associated with different types of anomalies,assigning a threat indicator score based on the result of the combining,and identifying a threat indicator if the threat indicator scoresatisfies a specified criterion.

FIGS. 32A-32B illustrate a second use case for identifying threatindicators based on combining the outputs (i.e. detected anomalies) fromdifferent anomaly models. In some embodiments, a threat indicator isidentified by processing the output from an anomaly model of a firsttype with a an anomaly model of a second type. Recall the previousexample of a beacon anomaly processed according to a rarity analysis todetermine if the beacon is rare for a given environment. That exampleinvolves processing event data 2302 according to a beacon detectionmodel to detect a beacon anomaly and then processing the detected beaconanomaly according to a rarity analysis model to detect a rarity anomaly.In some embodiments, if the second anomaly is detected, a threatindicator is identified.

As shown in FIG. 32A, anomaly 1 is detected based on processing of eventdata 2302 through anomaly model 1. Anomaly 1 is then input into anomalymodel 2 for processing. In some embodiments, the output anomaly 1 isprocessed along with other event data 2302 through anomaly model 2. Asecond anomaly 2 is detected based on processing anomaly 1 (and, and insome embodiments, event data 2302) through anomaly model 2. FIG. 32Bshows the same process as in FIG. 32A except that a threat indicator isnot identified because anomaly 1 was not detected. Although not shown,the same process may have yielded anomaly 1, but not anomaly 2. Forexample, a beacon anomaly is detected, but a rarity anomaly associatedwith that beacon is not detected because the beacon is common to aparticular environment. Accordingly a threat indicator is notidentified.

In some embodiments, the use case described in FIGS. 32A-32B involves aprocess of detecting a first type of anomaly based on processing event2302 data by a first type of anomaly model. The process continues withinputting the first type of anomaly into a second type of anomaly model.The process concludes with identifying a threat indicator if a secondtype of anomaly model is detected based on processing the first type ofanomaly by the second type of anomaly model.

The processes described in FIGS. 31A-32B depict simple combinations oftwo anomalies, however, the concept can easily be applied to morecomplex combinations of multiple anomaly outputs.

G. Identifying Threat Indicators—Enrichment of Anomaly Data

FIG. 33 illustrates a use case for identifying threat indicators byenriching the anomaly data using data from external sources. A detectedanomaly may provide more insight if combined with other data thatindicates a malicious nature. For example, consider the detection of ananomalous connection to particular domain xyz.com outside the computernetwork. The detected anomaly indicates that the domain may beassociated with malicious activity, however, beyond the fact that it mayappear machine generated or rare, additional information may be requiredto confirm that suspicion. It is therefore possible to access additionalexternal public information (e.g. a WHOIS lookup) that will provideadditional information about the domain, for example, who registered thedomain name and how long ago. A website registered very recently in acountry deemed to be “high risk” is likely to be viewed as moresuspicious. By incorporating the external information the, a confidencelevel that a particular anomaly is associated with malicious activitycan be increased, and in some cases a threat indicator identified.

As shown in FIG. 33, at step 3302 event data 2302 is processed throughan anomaly model resulting in detection of an anomaly at step 3304.Additional information from an external data source is obtained (e.g.,by a push or pull modality) at step 3306 during a process of dataenrichment resulting in annotated anomaly data at step 3308. Thisannotated anomaly data is processed according to threat indicator modeland a threat indicator is identified if a specified criterion issatisfied. In some embodiments, pulling this external information atstep 3306 (e.g. via a WHOIS lookup) is computationally expensive so itmakes sense to annotate the anomaly data 2304 instead of the highervolume event data 2302 if the enrichment process is occurring inreal-time or near real-time.

In some embodiments, the use case described in FIG. 33 involves aprocess that begins with identifying a particular entity associated withthe anomaly data. This identification may be based on the underlyingevent data used to generate the anomaly. As in the last example, ananomaly may be associated with a domain xyz.com. The process continueswith comparing the particular entity against data stored in an databaseof known security risks. For example, an external publicly availabledatabase may include a list of domains known to be associated withmalicious beacon activity. The process continues with identifying athreat indicator if the particular entity substantially matches a knownsecurity risk contained in the external database.

In some embodiments, the use case described in FIG. 33 involves aprocess that begins with identifying an anomaly associated with aconnection to a domain considered to be unfamiliar. The processcontinues with determining whether the domain considered to beunfamiliar matches a domain known to be a security risk, for example, byusing information from an external data source. The process continueswith identifying a threat indicator if the domain considered to beunfamiliar substantially matches a domain known to be a security risk.

H. Identifying Threats

FIG. 34 is a flow diagram depicting an example process 3400 foridentifying threats to the security of a computer network based onthreat indicators. The process of identifying threats based oncorrelation of anomalies is described in more detail elsewhere in thisspecification. The same concept applies here, except that the threat isidentified based on correlating the threat indicator data 2306 includinga plurality of identified threat indicators instead of the anomaly data2404.

Process 3400 begins at step 3402 with correlating the threat indicatordata 2306, or at least a subset of the threat indicator data 2306.Process 3400 continues at step 3404 with identifying a set of candidatesecurity threats based on the correlation. Types of correlation aredescribed elsewhere in this specification but can include network-widecorrelation for malware threats, connected component correlation forkill chain type threats, per-entity analysis for kill chain typethreats, and per-burst analysis for insider threats.

Process 3400 continues at step 3406 with comparing the subset of thethreat indicator data against pre-configured patterns or pre-set rulesassociated with each candidate threat. For example, an insider threatmay be associated with known patterns identified by security experts andtherefore be associated with pre-set rules. Process 3400 continues atstep 3408 with generating a pattern matching score based on a result ofthe comparing. In some embodiments, the pattern matching score is avalue in a set range. For example, the resulting pattern matching scoremay be a value between 0 and 10 with 0 being the least likely to be athreat and 10 being the most likely to be a threat.

Process 3400 concludes at step 3410 with identifying a security threatif the pattern matching score satisfies a specified criterion.Continuing with the given example, the specified criterion may be setsuch that an threat is identified if the pattern matching score is 6 orabove. The specified criterion need not be static, however. In someembodiments, the criterion is dynamic and changes based on situationalfactors. Situational factors may include volume of event data, presenceor absence of pre-conditional events, user configurations, volume ofdetected anomalies, and involvement of mission critical systems.

IX. Composite Relationship Graph

As described above, the security platform 300 can combine the individualevent-specific relationship graphs from all processed events into acomposite relationship graph that summarizes all significant (from asecurity standpoint) network activity for an entire enterprise ornetwork. The composite relationship graph can include nodes representingthe various entities associated with the network as well as nodesrepresenting the detected anomalies. Subsets, or “projections,” of thecomposite relationship graph can then be used by various differentthreat models to detect security threats, as will now be furtherdescribed.

FIGS. 35 through 38 relate to a method for storing and analyzing asecurity data structure (e.g., a graph including nodes and edges) foridentifying security threats in a computer network. The nodes represententities in or associated with the computer network, such as users,devices, applications, and anomalies. The edges, which connect nodes,represent the relationships between the entities. An ETL processgenerates event-specific graph data structures (also referred to as“mini-graphs” or “relationship graphs”) corresponding to events thathave occurred in the computer network. The method introduced heredetects anomalies based on the mini-graphs, and combines the anomalieswith the mini-graphs to generate the composite relationship graph, whichmay also be called an “enterprise security graph” to the extent it mayrelate to a network of a particular enterprise (e.g., a corporation,educational institution, government agency, etc.). The compositerelationship graph includes nodes that represent the anomalies and edgesthat represent relationships between anomalies and other entitiesinvolved in the events.

During the above-mentioned combining, the method condenses networkactivities that are of the same type and associated with the same userinto a single entry of combined network activity. The method furtherassigns these combined network activities into different projections ofthe composite relationship graph, depending on the type of activity.Each projection represents a subset of the composite relationship graphthat relates to a certain type or types of user action or other category(e.g., login, web visit, file access, anomaly, etc.). The projection canbe stored in a cluster (e.g., a Hadoop cluster) and further broken downinto multiple files based on the timestamps. Relevant files can bestored in proximity in the cluster for data access efficiency.

The method further identifies security threats by correlating theanomalies across the composite relationship graph. For example, themethod can use a neighborhood computation algorithm to identify a groupof related anomalies in the composite relationship graph that representa security threat. Alternatively, the method can identify an insider whoposes a security threat based on a group of anomalies being close toeach other in time and their confidence metrics.

FIG. 35 illustrates an example process of combining and storingrelationship graphs into a composite relationship graph. The processreceives event data from various data sources. The event data can be,e.g., timestamped machine data. The process uses parsers 3510 to conductan ETL procedure to generate information about the entities in thecomputer network and the relationships between the entities.

The process organizes the information about the entities and therelationships for each event into a mini-graph. Each of the mini-graphs3522, 3524 and 3526 includes nodes and one or more edges eachinterconnecting a pair of the nodes. The nodes represent the entitiesinvolved in the particular event. The edges represent the relationshipsbetween the entities in the event. An analytics engine 3530 can processthese mini-graphs 3522, 3524 and 3526 (e.g., using various machinelearning models) to detect anomalies.

A separate machine learning model called aggregator 3540 combines themini-graphs and detected anomalies into the composite relationshipgraph. The composite relationship graph includes nodes that representthe entities, as well as nodes that represent the detected anomalies. Insome embodiments, the composite relationship graph is created first involatile memory of one or more computing devices, and then saved tonon-volatile storage.

A graph library component 3550 handles the storage of the compositerelationship graph in a non-volatile storage facility called graphdatabase 3560. In the graph database 3560, the nodes (also referred toas vertices), edges and associated metadata of the compositerelationship graph are stored in one or more data files. The nodes andedges of the composite relationship can be partitioned based on thetimestamps (from the event data) of the corresponding networkactivities. Each data file can be designated for storing nodes and edgesfor a particular time period.

In addition, a graph merger component 3570 runs a background job tomerge new segments into the composite relationship graph at apredetermined periodicity. As the system continuously receives new eventdata and generates new mini-graphs and new anomalies based on the newevent data, the graph merger component 3570 merges these newly createdmini-graphs and associated detected anomalies into the compositerelationship graph.

FIG. 36 illustrates an example of a composite relationship graph. Theillustrated composite relationship graph 3600 includes a number of nodesU1 through U11 that represent users (also referred to as “user nodes”)and a number of nodes IP1 through IP7 that represent network devices(also referred to as “device nodes”). The composite relationship graph3600 further includes a number of nodes I1 through I4 that representanomalies (also referred to as “anomaly nodes”). For example, anomalynode I1 suggests that a user represented by node U5 has engaged incertain suspicious activity with, or in relation to, the devicerepresented by node IP3.

In graph 3600 there are three anomaly nodes I1, I2 and I4 connected tothe same device node IP3. These anomaly nodes may be indicative of asecurity threat involving the device IP3. The anomaly nodes I1, I2 andI4 also connect to the user nodes U4, U5 and U7 and device node IP5.This may indicate that users U4, U5 and U7 are suspicious, meaning theseusers can potentially be malicious users who engage in or will engage inactivities detrimental to the security of the computer network. Forexample, users U4, U5 and U7 may be invaders who have breached networkdevices with malicious intentions. Thus, a decision engine (e.g.,including a machine learning model) can identify a security threatrepresented by a group of nodes in question, including, in theillustrated example, anomaly nodes I1, I2 and I4, user nodes U4, U5 andU7, and device nodes IP3 and IP5.

The composite relationship graph can include a number of projectionsthat correspond to different categories of computer network activities.Each projection is a subset of the composite relationship graph andincludes edges representing computer network activities of a particularcategory. When the graph library component 3550 writes the compositerelationship graph into non-volatile storage (as shown in FIG. 35), thegraph library component 3550 can write the content of the differentprojections into separate data files. Alternatively, the graph librarycomponent 3550 can write the different projections into other types ofdata containers, such as logical unit numbers (LUNs).

FIG. 37 illustrates an example of how a composite relationship graph canbe stored as separate projections. For each edge (relationship) in thecomposite relationship graph, the graph library component 3550 examinesthe edge's type to determine the projection to which the edge belongs.The different projections in the illustrated example include a loginprojection 3710, a website-visit projection 3720 and an anomalyprojection 3730. In some alternative embodiments, the compositerelationship graph can include other types of projections, such as aprojection for activities of users accessing files stored in the devicesin the computer network.

If the graph library component 3550 determines that a particular edgecorresponds to an activity of a user logging into a device, the graphlibrary component 3550 assigns the particular edge to that particularlogin projection. For example, if the graph library component 3550determines that a particular edge corresponds to an activity of a uservisiting a website, the graph library component 3550 assigns theparticular edge to the website-visit projection 3720. If the graphlibrary component 3550 determines that a particular edge relates to ananomaly (e.g., the edge connecting to an anomaly node), the graphlibrary component 3550 assigns the particular edge to the anomalyprojection 3730.

The graph library component 3550 can further break down the projectionsinto a plurality of files. Each of the files stores network activitiesthat have occurred in a particular time period. For example, as shown inFIG. 37, the projection is broken down into a sequence of files, each ofwhich stores network activities that have occurred in one particularday. In some alternative embodiments, the graph library component 3550can further break down the projection into finer granularity. Forexample, the projection may be broken down into a sequence ofdirectories corresponding to days. Each directory may then include filescorresponding to each hour of the day.

In some embodiments, the graph library component 3550 can dynamicallyadjust the granularity. For example, in one embodiment, for networkactivities that occurred during the last two months, the graph librarycomponent 3550 may break down the projection data into filescorresponding to each hour of the last two months; whereas, for networkactivities that occurred prior to the last two months, the graph librarycomponent 3550 breaks down the projection data into files correspondingtwo months the graph library component 3550 may break down theprojection data into files corresponding to each week or each month. Astime goes by, some network activities stored in a daily granularitybecome older than two months. Thus, the graph library component 3550continuously combines files storing these network activities into filescorresponding to the weekly or monthly granularity.

FIG. 38 illustrates an example process of combining event-specificrelationship graphs into a composite relationship graph and detecting asecurity threat based on the composite relationship graph. At step 3810,the process receives event data representing a plurality of events on acomputer network. The event data are indicative of a plurality ofentities and at least one anomaly involved in the events. The entitiescan include various types of entities involved in the computer network.For example, the entities can include, e.g., devices in the computernetwork, users of the devices in the computer network, websites,applications and/or data files stored in the devices in the computernetwork.

At step 3820, for each event, the process acquires an event-specificrelationship graph (e.g., a mini-graph), for example, from the dataintake and preparation stage via the distributed messaging platform. Theevent-specific relationship graph is indicative of entities involved inthe associated event and one or more relationships between the entitiesinvolved in the event. The event-specific relationship graph includes anumber of nodes and at least one edge interconnecting nodes. The nodesrepresent the entities involved in the event. Each edge represents aninteraction between a pair of the entities.

At step 3830, the process acquires anomaly data indicative of varioussecurity-related anomalies detected from the event data. For eachanomaly detected from the event data, the computer system can furtherstore the event data associated with the anomaly in long-term(non-volatile) storage. In that way, the security platform 300 cangenerate a visualization of the event data associated with the anomalywhen the platform receives an instruction to visualize details of theanomaly.

At step 3840, the process condenses the computer network activities inthe event-specific relationship graph into combined computer networkactivities. For each event, the process identifies one or more computernetwork activities of a particular type based on the event-specificrelationship graph. The identified computer network activities areassociated with the same entity and occur during a predefined timeperiod. The process then combines the computer network activities of theparticular type into a data entry representing the combined computernetwork activity and counts the computer network activities that occurduring the predefined time period.

The process stores the data entry representing the combined computernetwork activity and the count in non-volatile storage, such as a datafile designated for the particular type and the time period. In someembodiments, the stored data entry for the combined computer networkactivity includes information about an activity type, an originatingentity, a target entity, the number of times the computer networkactivities occur in the time period, a start time, an end time, anaverage gap period between the computer network activities that occur inthe time period, or a standard deviation of gap periods between thecomputer network activities that occur in the time period.

At step 3850, the process combines the event-specific relationshipgraphs for the received events with the anomaly data into a compositerelationship graph. The composite relationship graph includes nodes thatrepresent the entities involved in the events and nodes that representthe anomalies detected based on the event data. The entities involved inthe events include at least two types of entities, such as users anddevices. The composite relationship graph further includes edges thatrepresent the relationships between the entities involved in the eventsand the anomalies.

As shown in FIG. 37, the composite relationship graph can include aplurality of projections. Each of the projections is a subset of thecomposite relationship graph that includes edges representing aplurality of computer network activities of a particular category. Insome embodiments, the particular category of network activitiescorresponds to users logging into devices in the computer network, usersvisiting websites, users accessing files stored devices in the computernetwork, or users conducting anomaly activities.

As illustrated in FIG. 37, one of the projections is the anomalyprojection 3730, which is a subset of the composite relationship graphthat includes edges representing anomalous activities conducted byusers. Each projection can be stored in a cluster of storage device anddistributed amongst data containers (e.g., files) based on timestamps ofthe associated event data. The computer system can further identifyevents that have timestamps satisfying a specific closeness criterion(e.g., the timestamps having differences less than a threshold value),and store the edge data of these identified computer network activitiesin proximity to each other in the long-term non-volatile storage. Inthis way, the read efficiency for the computer network activities can beimproved.

For each combined computer network activity, the computer system candetermine an association between the combined computer network activityof the particular type and a particular projection of the compositerelationship graph. Then the combined computer network activity isstored into a file designated for the associated projection.

In one embodiment, the computer system transfers the data structuresrepresenting the edges of the composite relationship graphs from memoryof the computer system to persistent (long-term) storage at apredetermined periodicity. For example, if the computer system detectsthat a time period since a last time of transferring the data structuresrepresenting the edges of the composite relationship graphs from memoryof the computer system to a persistent storage exceeds a thresholdvalue, the computer system transfers the data structures currently inmemory to the persistent storage. The computer system can further have amemory storage size limit. Once the size of the data structuresrepresenting the edges of the composite relationship graphs stored inthe memory exceeds the memory storage size limit, the computer systemtransfers the data structures currently in the memory of the computersystem to the persistent storage.

Referring again to FIG. 38, at step 3860, the process receives, at aspecified periodicity from one or more machine learning models, requestsfor data of a projection of the composite relationship graph andcorresponding to a time range. The requested data can include combinedcomputer network activities including information about computer networkactivities from multiple events. Since the requests from the machinelearning models are for data from a common projection range andcorresponding to a common time range, at step 3870, the process combinesthe data within the common projection range and the common time rangeinto a single input data structure as an input for the machine learningmodels.

In some embodiments, there are different types of machine learningmodels. Some machine learning model receives a portion (e.g.,projection) of the composite relationship graph as inputs and identifysecurity threats and/or anomalies based thereon. The one or more machinelearning models can be executed in a batch mode.

At step 3870, the process detects a security threat by processing atleast a portion (e.g., one or more projections) of the compositerelationship graph with a decision engine. The decision can be, e.g., amachine learning model or an analytics engine running a machine learningmodel. During the detection, the process first converts at least aportion of the composite relationship graph (e.g., the anomalyprojection) into an anomaly relationship graph. The anomaly relationshipgraph includes anomaly nodes that represent anomalies and entity nodesthat represent entities in the computer network. The computer systeminputs the anomaly relationship graph into the decision engine. Thedecision engine can then identify a security threat by analyzing theanomalies in any of various different ways.

One possible way is that a machine learning model identifies a set ofanomaly nodes interconnecting entities nodes that form a neighborhoodcluster in the anomaly relation graph. Another possible way is that themachine learning model identifies a subset of the anomaly relationshipgraph including anomaly nodes and entity nodes that have norelationships with other nodes outside of the subset in the anomalyrelationship graph. Yet another possible way is that the machinelearning model identifies a set of anomaly nodes directly connecting aparticular entity node in the anomaly relationship graph. The machinelearning model can further identify a group of anomaly nodes within theidentified plurality of anomaly nodes, wherein the group of anomalynodes have timestamps that satisfy a specific closeness criterion. Forexample, the timestamps may have an average time gap less than athreshold value.

At step 3880, as an optional step, the process confirms that theanomalies form a security threat by applying a security rule to theanomalies based on assigned categories of the anomalies. The computersystem can assign the anomalies into categories of, e.g., internalanomaly, malware anomaly, incoming anomaly and exfiltration anomaly. Anadministrator of the computer network can specify the rules based onhis/her knowledge of typical security threats that occur in the computernetwork.

The identified set of anomaly nodes represent a set of relatedanomalies. The process can present the security threat including the setof anomalies to an administrator of the computer network or any partythat handles security issues of the computer network.

Any of the steps in the process illustrated in FIG. 38 can be performedby processing logic of a machine learning model. Further, any of thesteps can be performed in real-time as the event data are received, orin a batch mode based on the event data retrieved from persistentstorage.

X. Graphical User Interface (GUI) Features

In addition to, and in conjunction with, methods and systems foranalyzing network activities to detect, identify, and track threats andanomalies on a computer network, the present disclosure relates tomethods and systems for organizing and presenting information concerningpotential network compromise to one or more users tasked with monitoringthe network and thwarting attacks, stolen data, and other harm.Embodiments of the present disclosure include an innovative graphicaluser interface that is visually communicative, highly integrated,adaptable, and user interactive.

As described below with reference to FIGS. 39 through 51, the graphicaluser interface (“GUI”) introduced here enables a user to configuredisplays according to the user's particular tasks and priorities. Thesecurity platform described herein may include a GUI generator modulethat gathers the generated anomaly data, threat data, and other data,and that based on such gathered data, generates display data. The GUIgenerator module sends the generated display data to one or morephysical display devices, to cause those display devices to display theGUI features described herein. The GUI module also receives user inputsand modifies the display data based on those inputs to provide aninteractive display.

In the described GUI, graphs, timelines, maps, charts, lists and othervisualization features are generated to illustrate trends, recentactivity, and relationships between different data. The GUI can provideviews that are automatically configured via default settings, or the GUIcan enable a user to customize a view, for example, to filter out datapoints that are less critical, distracting, or unnecessary, to zoom inand out, or re-format the view (e.g., from a line chart to a bar chart).To easily navigate between different views, and to better understand therelationships between different data associated with a security-relatedthreat or anomaly, the GUI can include links in the data to generatedifferent views that provide additional detail about information ofinterest.

The GUI also can enable the user to set watchlists to track informationwhile navigating the various views. Watchlists can be used, for example,to remind the user that certain data already has been reviewed andconsidered by the user. Once a user reviews sufficient information todraw a conclusion about a threat, the GUI also enables a user to “takeaction,” for example, by re-designating the identified threat as “Not aThreat,” or by emailing threat data or exporting it to another datamining platform. The GUI provides these capabilities and many more tofacilitate effective network security monitoring via simple user inputs(such as point-and-click actions), with little or no typing and withoutrequiring the user to engage in laborious set-up or programming.

The GUI introduced here generates views pertaining to threats andanomalies identified from event data generated from network activities.As examples, network activities may include log-ins, email traffic,internet browsing, or file transfers on a network operated by acorporation, university, household, or other organization (referred tocollectively as an “organization”). Event data comprises timestampedmachine data related to network activity by various entities, includingusers, devices, and applications.

“Users” may be employees or others who are associated with anorganization. Users might have unlimited rights or privileges to accessan organization's network, or they might be authorized to have onlylimited network access. When user identification information is includedin event data, it may appear as a “username” or “User ID” (or “UserID/Password” combination). Typically, users are registered with anaccount on an organization's network. Whenever a user logs into theorganization's network or server(s), from any location and using anydevice, event data is created that can be tracked for potentialinstances of network compromise.

“Devices” may be machines that access the network. For example, a devicemight be an IP address associated with a client computer (laptop,desktop, tablet, smartphone, etc.), server, and/or any other machinecapable of accessing the organization's network. A device may beoperated by a user who is registered with the network, or it may beoperated by someone else who can access the network, either in anauthorized or unauthorized capacity. For example, many organizationsallow guests to access their networks or allow network traffic byvisitors to the organization's website. Emails and other file transfersfrom users to others outside the organization, such as clients,customers, etc., involve communications with devices that are externalto the organization's network. When a device accesses the network, anetwork server generates logs and other machine data that identify thedevice, for example, by IP address. Machine data that includes deviceinformation is additional event data that also can be tracked forpotential instances of network compromise.

“Application information” identifies a program that is executed on anetwork's servers or on a computer in communication. For example, anapplication might be run by a user without proper authorization, or byan intruder outside the organization. The application may be malware, orit might be authorized software that has become infected with a virus.Machine data that includes information about application activity is yetanother example of event data that can be tracked for potentialinstances of network compromise.

In one aspect of the techniques introduced here, the event data isanalyzed, via various machine learning techniques as disclosed herein,to identify anomalies from expected or authorized network activity orbehavior. An “anomaly” in the context of this description is a detectedfact, i.e., it is objective information, whereas a “threat” (discussedfurther below) is an interpretation or conclusion that is based on oneor more detected anomalies. Anomalies can be classified into varioustypes. As examples, anomalies can be alarms, blacklistedapplications/domains/IP addresses, domain name anomalies, excessiveuploads or downloads, website attacks, land speed violations, machinegenerated beacons, login errors, multiple outgoing connections, unusualactivity time/sequence/file access/network activity, etc. Anomaliestypically occur at a particular date and time and involve one or moreparticipants, which can include both users and devices.

In another, related aspect of the disclosure, the event data is analyzedto identify threats. Threats are interpretations or conclusions basedon, and therefore associated with, one or more anomalies. Threats can becategorized or grouped into various types, both external and internal tothe organization. Examples of threats include data exfiltration (bycompromised account, by malware, or by a suspicious user or device),public-facing website attack, suspicious behavior by an insider, andbreach of a rule (such as a blacklist, file transfers). Like an anomaly,a threat can be associated with one or more participants, includingusers, devices, and applications. A threat need not have a specificevent date, because it might be ongoing, in which case it can have astart date and a date of last update. Each threat is based on at leastone anomaly.

Because network security monitoring can involve tracking networkactivity by users, devices, and applications (referred to collectivelyas “entities”) to identify and track anomalies and threats (referred tocollectively as “instance of potential network compromise,” or“instances”), a graphical user interface for a user in accordance withthe present disclosure also organizes, tracks, and presents informationconcerning these entities and instances of potential network compromise.Since information pertaining to different entities and instances may beinterrelated, the graphical user interface, in accordance with variousembodiments of the present disclosure, provides various views forcausing display of this information. The graphical user interface alsoincludes links in these views to cross-reference the information. Thesecapabilities facilitate a user's ability to understand the connectionsand relationships between different entities and/or instances to betterunderstand security risks and causes of a problem.

For example, the graphical user interface provides several differentways for a user to access information pertaining to a particular devicethat seems suspicious. The user may search for the device directlythrough a “device view.” Alternatively, the user may notice the devicewhen reviewing a threat, and then click on a link for the device fromwithin a threat view. Instead, the user might become aware of the devicewhen reviewing information about an anomaly, and click on a link for thedevice from an anomaly view. As yet another alternative, the user mightnotice the device when navigating a “user view,” and clock on the linkfrom within the user view. Once the user reviews information about thesuspicious device, the user can use a “watchlist” to “mark” the device(e.g., as suspicious). Once the device is put in the watchlist, thattracking information can stay with the device and obtained upon accessdevice information from any view.

In accordance with various aspects of the present disclosure, FIG. 39Aprovides an example high level, “home screen” view 3900 generated bydisplay data for display in a graphical user interface (“GUI”). This maybe the first screen viewed after log-in. Toolbar 3901 also may beincluded in all views generated for display in the GUI. In this example,the toolbar includes a “Views” tab 3902, “Analytics” tab 3903, “Config”tab 3904, and GUI user name tab 3905 for log-in.

By clicking on the “Views” tab 3902, as shown in FIG. 39B, a GUI usercan toggle the GUI between a “Threats” view 3906, “Anomalies” view 3907,“Users” view 3908, “Devices” view 3909, and “Applications” view 3910. Asdescribed in further detail below, the “Threats” view 3906 provides alisting of all active threats and the “Anomalies” view 3907 provides alisting of all anomalies. The “Users” view 3908, “Devices” view 3909,and “Applications” view 3910 provide separate listings for each type ofentity (namely, users, devices, and applications, respectively) that isassociated with an anomaly or threat.

Returning to FIG. 39A, the home screen view 3900 also may include asummary status bar 3911 indicating, for example, the number of threats,anomalies, total users, total devices, total apps, and total sessions onthe network being monitored. The summary status bar can enable the GUIuser to see, at a glance, the volume of information that can be reviewedand evaluated.

The home screen view 3900 can additionally include summary charts andillustrations, such as, as shown in FIG. 39A, a “Threats by Threat Type”box 3912, a “Latest Threats” box 3913, and an “Events Trend” graphic3914. The “Threats by Threat Type” box 3912 compares by number eachdifferent type of threat that has been identified. The listing in the“Latest Threats” box 3913 identifies the most recent threats by date.The “Events Trend” graphic 3914 is a timeline showing the volume ofevents along a timeline.

The example home screen view 3900 also prompts a user, via status bar3911, to begin a “Threat Review” or view an “Analytics Dashboard.” Uponclicking, via the graphical user interface, on the “Start Threat Review”button 3915, a “Threats Review” view 4000 is provided, as described withreference to FIG. 40A.

As shown in FIG. 40A, an example “Threats Review” view 4000 enables auser to separately click through each active threat that has beenidentified from the event data. In the upper-right of the view, a countand toggle 4001 enables the user to step through each identified threat.

The view 4000 can include a filter section 4020 that enables the user toselectively filter out threat results according to time, severity, ortype. For example, as shown in FIG. 40B, the default provides views of“All Threat Types” 4021 but a user can change this to just review pagesfor “External,” “Insider,” or “Rule-Based” threats. The filter section4020 also provides an option to “Select Threat Types,” which enables theuser to select the specific types of threats to be included in theThreat Review. The filter section 4020 also enables the user to filterout threats based on their scores by clicking the “Scores” tab 4022.(For example, if the user is only interested in evaluating high riskthreats, the user might filter out any threats with a score less than5). The user can also click on the “Time” tab 4023 to filter out threatsbased on a date range. For example, if the user is only interested inevaluating very recent threats, the user can choose to filter out anythreats earlier than the past 24 hours.

Returning to FIG. 40A, each “Threat Review” view 4000 can identify aparticular threat by its type and provides a summary description 4002along with a threat score 4003. The threat score, determined based onmachine learning from the event data, provides an indication of theseverity of the risk for network compromise associated with the threat.

The “Threats Review” view 4000 can additionally include a status chart4004 that provides a Timeline, list of Anomalies, list of Users, list ofDevices, list of Apps, and a suggestion of “What Next.” The Timelineidentifies the date that the threat began, the last update concerningthe threat, and the duration of time that the threat has been active.The list of Anomalies identifies each type of anomaly that is associatedwith the threat and how many anomalies of each type. The list ofAnomalies also provides a score for each type of anomaly, whichindicates the severity associated with each type of anomaly. The list ofUsers identifies each user associated with the threat and provides ascore for each user. Similarly, the list of Devices and list of Appsidentify each device (by IP address) and App (by file name/type),respectively, along with a score.

For each entity (e.g., user, device, and app), a link is included suchthat, if the link is clicked, the user is taken to a separate view forthat selected entity. For example, if the link associated with “MarkPittman” 4005 is clicked, a “Users Facts” page 300 within the ThreatsReview is generated, as can be seen from FIG. 41.

Returning again to FIG. 40A, Threats Review view 4000 additionallyprompts the user to take “Actions” 4010, view additional “Details” 4011,or set up a “Watchlist” 4021. By clicking on the “Actions” tab 4010, theuser can select from several options, as shown in FIG. 40C. If the userdetermines that the threat is not a concern, the user can select “Not aThreat” 4011. By making this selection, the user instructs the networksecurity system to delete the threat page from the Threats View and tono longer identify it as a threat. As a consequence, the total number ofthreats will decrease (as will be depicted in the status bar 3911 inFIG. 39A). Another option in the “Actions” tab 4010 is the “EmailThreat” selection 4012, which enables the user to email the threat to adesignated email address. Yet another option is the “Export” selection4013, which enables the user to export data associated with the threatto another data mining platform.

As shown in FIG. 40A, the Threats Review view 4000 also includes a“Details” tab 4011. When the user selects this tab, in the exampleprovided in this figure, the Threats Review view is augmented withseveral additional charts and graphics, as shown in FIGS. 40D, 40E, and40F, as will be described next.

FIG. 40D illustrates a “Threat Relations” flow 4040, which depicts therelationship between users, devices, and applications that areassociated with the threat. Dotted lines connect one or more entitiesthat are participants together in one or more anomalies associated withthe threat. For example, in this flow, device “10.116.240.105” isconnected via a dotted line with “10.1.21.153,” which runs application“ms-ds-smb” and is associated with “Fred Samuels” and “Mark Pittman.”The dotted is color-coded to indicate that it is “minor” in nature.

When a user “hovers” the cursor over (or highlights) the name of a user,device, or application (or an arrow pointing to the user, device, orapplication), display data generates a bubble in the GUI view thatprovides a high-level summary of information about that entity. Forexample, hovering over “Mark Pittman” causes bubble 4043 to appear,which indicates that “Mark Pittman” is associated with three anomalies:two “Land Speed Violations” (color-coded to indicate that these areconsidered “major”) and one “Unusual Activity Time.”

In this example, the bubble 4043 additionally prompts the user to clicka “View All 3 Anomalies” link. As shown in FIG. 42, clicking on thislink causes the GUI to generate an Anomalies Table view 4200 that listsand provides high-level information about the three anomalies.

Instead of, or in addition to, hovering the cursor over an entity, theuser can click on an entity to select to receive a view concerning thatentity. For example, if the user clicks on “Mark Pittman,” the GUIgenerates a “User Facts” view 4100 for Mark Pittman, as shown in FIG.41.

FIG. 40D illustrates a “Kill Chain View” 4050 associated with thethreat. The Kill Chain view illustrates three stages of the threat:“Intrusion” 4051, “Expansion” 4052, and “Exfiltration” 4053. For eachstage, the GUI includes a summary of the anomaly or anomalies in thatstage. For example, two Land Speed Violation anomalies 4054 occurredduring the “Intrusion” stage. The GUI indicates that one of theseviolations 4056 was from Pittsburgh, in the US, to Beijing, in China.The GUI indicates the number of times that land speed violation occurred(once) and provides a color-code to indicate the severity of thatviolation as it relates to the threat.

The GUI can include a link for each anomaly in stages 4051, 4052, and4053 of Kill Chain 4050 in FIG. 40D. For example, by clicking on “LandSpeed Violation from Pittsburgh, US, to Beijing, China” 4056, the usernavigates to Anomaly Details view 4300 for this selected anomaly, asshown in FIG. 43. In the example view provided in FIG. 40D, the twoanomalies associated with the Exfiltration stage 4053 are both“Excessive Data Transmission” 4055. These ae color-coded in red toprovide an indication of their high level of severity.

The Kill Chain view additionally can include a timeline 4057 thatillustrates the timing of each phase. In this example in FIG. 40D, theIntrusion phase 4051 is associated with 3 anomalies, beginning on Nov.15, 2014. The Expansion phase 4052 is associated with 8 anomalies,beginning on Nov. 21, 2014, and concluding on Nov. 23, 2014. TheExfiltration stage 4053 is associated with 2 anomalies, beginning onDec. 1, 2014, and concluding (or their last update occurred) on Dec. 3,2014.

Returning to FIG. 40A, clicking on the “Details” tab 4011 in the ThreatsReview view 4000 also can generate illustrations of a Threat AnomaliesTimeline 4060, Threat Anomalies Trend 4070, and Threat Anomalies listing4080 and Device Locations 4090, in FIGS. 40E and 40F.

Referring to FIG. 40E, Threat Anomalies Timeline 4060 provides atimeline of each anomaly, sorted by anomaly type. In this example, thereare four anomaly types: “Excessive Data Transmission,” “Land SpeedViolation,” “Unusual Network Activity,” and “Unusual Activity Time.” Thetimeline shows a circle corresponding to each occurrence, which iscolor-coded to indicate its severity. If there is more than one anomalyof the same type on the same date, the circle is made larger. Byhovering over a circle, a bubble is generated that provides the date ofthe anomaly or anomalies and prompts the user to select more detailedinformation (not shown). Upon clicking on a bubble, the GUI generates anassociated Anomalies Table view 4200, in the format shown in FIG. 42.

FIG. 40E additionally includes Threat Anomalies Trend 4070. Thisprovides a line graph indicating the number of anomalies during periodsof time. With this illustration, a GUI user can quickly discern whethera large number of anomalies occurred on a particular date or timeperiod, and whether there is a trend of increasing or decreasinganomalies. By hovering over a point on the line, the GUI generates abubble indicating the date and number of anomalies on that date. Similarto the Threat Anomalies Timeline 4060, upon clicking on a bubble, theGUI generates an associated Anomalies Table view 4200, in the formatshown in FIG. 42.

The “Details” version of the Threats Review view 4000 also includes aThreat Anomalies listing 4080. In the listing, each entry is associatedwith an “Anomaly Type” 4082, one or more “Participants” 4083, a“Summary” 4084, an “Event Date” 4095, and a “Score” 4086. For example,“Land Speed Violation” 4087, the first listed anomaly type, isassociated with three “Participants,” user “Mark Pittman” and devices“1.94.32.234” and “66.39.90.214.” The listing summaries that the anomalyis “From Pittsburgh, US to Beijing, CN,” and indicates that the anomalyoccurred on “Nov. 15, 2014.” The score associated with the anomaly is“5”. By clicking on “Land Speed Violation,” the GUI navigates to AnomalyDetails view 4300 as shown in FIG. 43.

The listing of Anomalies 4080 provides a summary indicating each type ofanomaly associated with the threat and the number of anomalies per type.The default for the listing is to display all anomalies as indicated bythe “All Anomalies” tab 4081, but a GUI user can opt to view onlyanomalies of a selected type.

Referring to FIG. 40F, the detailed version of the Threats Review page4000 also includes a Devices Location map 4090. This map provides avisual indication of the location of the devices associated with thethreat. Device is represented on the map by a circle, color-coded toindicate the score, or severity of risk associated with the device orlocation. If there are multiple devices at a single location (orvicinity), it is represented by a larger circle. In FIG. 40F, there arefour locations represented, one in China, two in California, and one inPittsburgh, Pa. By hovering over a circle, such as 4092, the GUIgenerates a bubble, as shown in FIG. 40G, that provides more detailedlocation information (in this case, “Beijing-China”), the device name/IPaddress (“1.94.32.234”), and a link to “View Device Details.” If the GUIuser clicks on the link, the GUI navigates to the User Facts view 4100of FIG. 41.

Devices Location map 4009 also includes color-coded lines that connectthe devices. For example, line 4093 connects the devices represented bycircle 4091 to the device represented by circle 4092. The linescorrespond to the one or more anomalies for which the connected devicesare participants. As shown in FIG. 40H, by hovering over line 4093, theGUI generates a bubble 4095 that identifies each anomaly represented bythat line and a color-code indicating the score for that anomaly. Thebubble 4095 additionally includes a link for the GUI user to view allassociated anomalies (e.g., “View All 2 Anomalies”). Upon clicking onthe link to view all anomalies, the GUI navigates to the associatedAnomalies Table 4200, in the format shown in FIG. 42.

As can be seen, the GUI introduced here enables a user to access thesame views and information via several possible navigational paths. Forexample, link 4056 in the Kill Chain view in FIG. 40D, link 4087 in theThreat Anomalies listing in FIG. 40D, and link 4201 in the AnomaliesTable in FIG. 42 each navigate to the “Land Speed Violation” AnomalyDetails view 4300 in FIG. 43. Similarly, there are several paths (viathe charts, diagrams, listings, and maps shown in FIGS. 40E, 40F, 40G,and 40H, to access User Facts 4100 in FIG. 41 and Anomalies Table 4200in FIG. 42.

As shown in FIG. 40A, Threats Review page 4000 additionally includes“Watchlist” tab 4012, which enables the GUI user to track the threat.Upon clicking on tab 4412, as shown in FIG. 44A, the GUI provides abubble 4400 prompting the user to tag the threat with “ThreatWatchlist,” “False Positive,” “Important,” “Reviewed,” “Save for Later,”or to define a new category for tagging (via the “New Threat Watchlist”selection). The tag remains associated with the threat until the GUIuser changes the watchlist. For example, by designating the threat as“Reviewed” 4410, as shown in FIG. 44A, the GUI associates the threat as“Reviewed” in subsequent reviews of the threat, as shown at 4411 in FIG.44B.

In addition to providing threat, anomaly, and entity information invarious views via the “Threat Review,” the GUI also enables users todirectly navigate to desired views containing the same information viathe Views tab 3902 as shown in FIG. 39B. The Views tab 3902 can beaccessed from any view in the GUI. As shown in FIG. 39B, the Views tab3902 enables a user to toggle between a Threats view 3906, Anomaliesview 3907, Users view 3908, Devices view 3909, and Applications view3910.

FIG. 45A provides an example view that the GUI generates when a GUI userselects the Threats view 3906 in FIG. 39B. The Threats Table view 4500provides a Threats Trend timeline 4510 and a Threats listing 4520. TheThreats Trend 4510 illustrates the number of threats over a period oftime. This can be provided as a line chart, as shown in FIG. 45A. Asalternatives, the same information can be re-formatted as a columnchart, as shown in FIG. 45B, or as a breakdown column chart as shown inFIG. 45C.

While viewing the Threats Trend 3906 (in any format), the GUI user canuse the cursor to hover over displayed data to receive more specificinformation. For example, referring to FIG. 45A, hovering over the dataon the line at 4511 causes a text bubble 4512 to appear, indicating aspecific date (or time) and the number of threats at that point, asshown in FIG. 45D.

Referring back to FIG. 45A, the Threats listing 4520 lists all activethreats. The Threats listing provides, for each entry, the Threat Type4530, Participants 4531, Event Date 4532, Last Update 4533, and Score4534. A summary section 4535 identifies the number of threats of eachtype and provides an option to just display the threats of a certainspecified type.

In FIG. 45D, if the GUI user clicks on the text bubble 4512, the Threatslisting 4520 changes to display only the subset of threats that areassociated with the selected date on the timeline. To receive specificinformation about a threat in the subset of threats, the GUI user clickson a link in the Threats listing 4520. The GUI then navigates to theThreat Details page 4540, as shown in FIG. 45E. This page provides thesame information (including the same charts, graphs, etc.) provided inthe Threats Review page 4000 when the “Details” tab 4011 is selected. Inthe same manner as shown in FIGS. 40A-40E and as described above withreference to those figures, the Threats Detail page 4540 also providesthe same summary chart, Threats Relations graphic, Kill Chain view,Threat Anomalies Timeline, Threat Anomalies Trend, Threat Anomalieslisting, and Device Locations map. And as in FIG. 2, the Threats Detailpage 4540 also enables the GUI user to create a Watchlist or to takeAction.

Finally, while viewing Threats Table 4500, the GUI user can navigate tothe User Facts view 4100 in FIG. 41 or the Anomaly Details 500 in FIG.43 in largely the same manner. For example, from within the Threatslisting 4520 on FIG. 45A, a GUI user can click on the link for anyparticipant (user, device, or application) and then receive the UserFacts view 4100. As another example, from the Kill Chain view in FIG.45E, a GUI user can select any anomaly associated with a phase in theKill Chain (namely, intrusion, expansion, and exfiltration, and view theUsers Table or equivalent information concerning other entities.

FIG. 46A provides an example view that the GUI generates when a GUI userselects the Anomalies view 3907 in FIG. 39B. The Anomalies table 4600provides an Anomalies Trend timeline 4610 and an Anomalies listing 4620.The Anomalies Trend 4610 illustrates the number of anomalies over aperiod of time. This can be provided as a line chart, as shown in FIG.46A. As alternatives, the same information can be re-formatted as acolumn chart, or as a breakdown column chart (not shown), analogous tothe Threat Trend as shown in FIGS. 45A-45C.

While viewing the Anomalies Trend 4610 (in any format), the GUI user canuse the cursor to hover over displayed data to receive more specificinformation. For example, referring to FIG. 46A, hovering over the dataon the line at 4611 causes a text bubble to appear, indicating aspecific date (or time) and the number of anomalies at that point (notshown).

In the Anomalies Table view 4600, the Anomalies listing 4620 lists allactive anomalies. The Anomalies listing provides, for each entry, theAnomaly Type 4630, Participants 4631, Summary 4632, Event Date 4633, andScore 4634. To the left of the listing, the view identifies the numberof anomalies of each type and provides an option to just display theanomalies of a certain specified type.

As shown in FIG. 46B, if the GUI user clicks on the graph of theAnomalies Trend at 4611, the Anomalies listing 4620 changes, asindicated at 4641, to display only the subset of anomalies that areassociated with the selected date on the timeline, as shown at 4642.

To receive specific information about an anomaly, the GUI user can clickon an entry in the Anomaly listing 4620. Each entry is a link. Uponclicking, the GUI navigates to an Anomaly Details view 4650 thatcorresponds with the selected entry in the Anomaly listing. An exampleof an Anomaly Details view 4650 is shown in FIGS. 46C-46E. The AnomalyDetails view 4650 provides specific information, charts and graphicsabout the selected anomaly, along with additional links to the entitiesthat participated in the anomaly.

As can be seen in FIG. 46C, the Anomaly Details page 4650 can include asummary section 4651 identifying the anomaly by type (e.g., “Unusual ADActivity Sequence”), event date (e.g., “Jan. 2, 2014 10:10 PM”) a shortdescription (e.g., “An unusual event appeared for this account Login . .. .”), and a score (e.g., “5”).

For the anomaly corresponding to the Anomaly Details view 4650 (“UnusualAD Activity Sequence”), a single user is the only entity that isassociated with the anomaly. The Anomaly Details view 4650 includes abox identifying the “Users” 4652 (e.g., “Clint Dempsey”) along with theuser's associated score (e.g., “4”). “Users” can include all personnelin the organization who caused the anomaly, were victims, or otherwiseparticipated in some network activity that triggered the identificationof the anomaly.

In this example, the Anomaly Details view 4650 additionally includes an“Anomaly Relations” box 4653. This box illustrates the connection, or“relationship” between different entities (users, devices, andapplications) that participated in the anomaly. Since, in the exampleAnomaly Details page 4650, there is only listed User, the “AnomalyRelations” graphic is left blank.

FIG. 46F provides a second example of an Anomaly Details view, this timefor a “Machine Generated Beacon” that occurred on Jul. 27, 2014 at 4:36PM, as shown at 4655. This anomaly is associated with 4 entities: User“ggawrych” 4656, Internal Device “10.104.31.18” and External Device“46.214.107.142” 4657, and Domain “46.214.107.142” 4658. AnomalyRelations box 4659 illustrates the relationship between these entities.As can be seen, User “ggawrych” uses Internal Device “10.104.31.18” toaccess domain “46.214.142” operating on External Device“46.214.107.142.”

Returning to the Anomaly Details view 4650 in FIG. 46C, the detailedview additionally includes a “Triggering Event” box 4654. This boxprovides the event data that triggered identification of the anomaly.

FIG. 46D illustrates an “Anomalous Activity Sequence” box 4660 in theAnomaly Details view 4650. Given that the type of anomaly in AnomalyDetails view 4650 is an “Unusual AD Activity Sequence,” this graphicillustrates the string of activities that triggered the anomaly. It isworth noting that this graphic would not apply for other types ofanomalies, such as the “Machine Generated Beacon” 4655 of FIG. 46F.Accordingly, each Anomalies Detailed View provides different boxes andgraphics to illustrate parameters that correspond to the type of anomalyin the view.

FIG. 46E provides additional boxes that may be associated with the“Unusual AD Activity Sequence,” in Anomaly Details view 4650. Thisincludes “User Activities Baseline” box 4661, which illustrates thetypical activities for the user that do not trigger an anomaly and the“Compare Unusual Activity with the Account's Profile” box 4662. Finally,the Anomaly Details view 4650 may include a box for “AdditionalInformation” 4663 and an “Anomaly Graph” box 4664 illustrating therelationship between the user and the anomaly.

Similar to the “Threats” view in FIGS. 45A-45E, the “Anomalies” view inFIGS. 46A-46F includes a multitude of links by which the GUI user cannavigate to additional pages. For example, in FIG. 46A, upon selectionof one of the “Participants” in the Anomalies listing 4620, if the“Participant” is a user, the GUI will generate a “User Facts” viewcorresponding to the user, similar to that in FIG. 41. If the“Participant” is a device or application, then the GUI will insteadgenerate a “Device Facts” or “Application Facts” view (not shown). Inthe same manner, the user, device or application can be selected in theAnomaly Details view, such as in FIG. 46C or FIG. 46F, to generates the“User Facts,” “Device Facts,” or “Application Facts” views. Also, theGUI user can configure the “Watchlist” from the Anomaly Details view, ina similar manner as for the Threat Details view.

Returning to FIG. 39B, by selecting the “Users” toggle in the “Views”tab 3902, the GUI user navigates to a “Users Table” view 4700 asillustrated in FIG. 47A. The “Users Table” provides a list of each userthat is associated with a threat or anomaly. The listing can include theuser name 4701, the Department in which the user works in theorganization, if known from the event data or other data, the number ofassociated anomalies 4703, the number of associated threats 4704, thedate and/or time of the most recent update 4705, and the scoreassociated with that user 4706.

By clicking on an entry in the Users Table view, such as “Rick Browne”4707, the GUI navigates to the Users Facts view 4710 for that selecteduser, as shown in FIG. 47B. The User Facts view can include a summarysection 4717 providing, for example, the number of threats 4711, thenumber of anomalies 4712, the number of total sessions 4713, the numberof anomalous sessions 4714, and the number of events 4715. The view canadditionally include a “User Score Trend” box 4716, which illustratesthe change, if any, in the score associated with the user over a periodof time.

The Users Table view 4707 can additionally include a user profile box4720 indicating, for example, the user's HR (human resources) status,Department in the organization (e.g., “Sales”), email address, login ID,Phone number, Address, and AD groups. The profile box may also includeinformation concerning Similar Users, Top Devices, and Top Apps. As alsoshown in FIG. 47C, the Users Table view may also include a User EventsTrend box 4721, which depicts how many events that the user participatedin over a time period. A sudden increase in the number of events can beuseful in evaluating potential network compromise. As yet anotherexample, the Users Table view can provide a User Events Classes box4722, which shows the number of each class of events for which the userwas a participant.

Referring back to FIG. 47B, each number in the summary section 4717 canprovide a link to other views. For example, by clicking on the number ofthreats (“1”) 4711, the GUI generates a “User Threats” view 4730 asshown in FIG. 47D. The “User Threats” view 4730 can include a summarysection, including, for example, the number and type of each associatedthreat 4731, the number and type of each associated anomaly 4732, thenumber of devices operated by the user that have been associated withanomalies 4733, and the domains involved in the anomalies that the useraccessed 4734. The summary view additionally can include an associatedscore for each threat, each anomaly, and each device. Each deviceidentified in 4733 can provide a link to a “Device Facts” view thatcorresponds to that selected device, as further described below.Likewise, each domain identified in 4734 can provide a link to a “DomainFacts” view that corresponds to that selected domain, as also furtherdescribed below.

The “User Threats” view 4730 also may include a “User Threats Timeline”box 4735 that visually depicts when the user became associated with eachtype of threat identified in 4731 and the duration of that threat. Thedata on the timeline can be color-coded according to the score of thethreat. Hovering (or highlighting) the data on the timeline causes theGUI to generate a text bubble that summarizes the identity and timing ofthe threat.

Finally, the “User Threats” view 4730 also may include a “User Threats”listing 4736, which, for each threat associated with the user,identifies the threat type, all participants, the last update, and thescore. In the example shown in FIG. 47D, there is a single entry in thelisting because there is one threat associated with the user. Byclicking on an entry in the listing, the GUI user navigates to the“Threats Details” view corresponding to that threat, similar to “ThreatsDetails” view 4540 of FIG. 45E.

Referring back to FIG. 47B, by clocking on the number of anomalies(e.g., “2”) 4713, the GUI generates a “User Anomalies” view 4740 asshown in FIG. 47E. The “User Anomalies” view 4740 can include the samesummary of information section provided in the “User Threats” view 4730.The “User Anomalies” view 4740 additionally can include a “UserRelations” box 4741, which illustrates the connections between the user(“Rick Browne”), the Internal device that he operates(“10.104.105.166”), and the external device (“46.214.107.142”) anddomain (“mpdhgokh.ddns.net”) that he communicated with when the anomalywas triggered.

The “User Anomalies” view 4740 additionally can include a “UserAnomalies Timeline” box 4742. The timeline depicts each anomaly that isassociated with the user as a circle and indicates the date that theanomaly occurred. In this example, it can be seen that two anomalies,“Exploit Chain” and “Machine Generated Beacon,” both occurred on Jul.28, 2014. View 4740 also may include a “User Anomalies Trend” box 4743,indicating how many anomalies occur on each date. As shown in FIG. 47F,the “User Anomalies” view 4740 also can include a “User Anomalies” box4744 that lists each anomaly and for each, it identifies eachparticipant, a summary of the anomaly, the event date, and the score. AGUI user can click on the listing to navigate to an “Anomaly Details”view, similar to that shown in FIGS. 46C and 46F. The GUI user can alsoclick on a device or domain identified in the “Participants” columnshown in FIG. 47F to navigate to a “Device Facts” view that correspondsto that selected device, as further described below. Likewise, eachdomain identified in 4744 can provide a link to a “Domain Facts” viewthat corresponds to that selected domain, as also further describedbelow.

Finally, the “User Threats” view 4730 and “User Anomalies” view 4740each may include a “Watchlist,” the functionality was explainedpreviously with reference to FIG. 44A. A “Watchlist” for a user 4745 isshown in FIG. 47G.

Returning again to FIG. 1B, by selecting the “Devices” toggle in the“Views” tab 3902, the GUI user navigates to a “Devices Table” view 4800as illustrated in FIG. 48A. Analogous to the “Users Table” 4700described above with reference to FIG. 47A, the “Devices Table” providesa list of each device that is associated with a threat or anomaly. Thelisting can include the IP Address 4801, the Scope (e.g., “External” or“Internal”) 4802, the number of associated anomalies 4803, the number ofassociated threats 4804, the date and/or time of the most recent update4805, and the score associated with that user 4806.

By clicking on an entry in the “Devices Table” view, such as“207.46,1.127” 4807, the GUI navigates to the “Devices Facts” view 4810for that selected device, as shown in FIG. 48B. The “Devices Facts” viewcan include a summary section and other information, such as a “DeviceScore Trend” box 4811, which indicates the date that the device wasassigned a score and whether that score has changed over time. The viewcan additionally include a “Device Score Trend” box 4811, whichillustrates the change, if any, in the score associated with the userover a period of time. As other examples, the “Device Facts” view 4810may include a “Top Users” box 4812, which indicates whether there areone or more primary users for the device, and a “Top Apps” box 4813,indicating whether, from the event data, it can be discerned whetherthere are any known applications running on the device. As with the“User Facts” table, a “Watchlist” tab 4814 is provided.

In the example of FIG. 48B, by clicking on the Anomalies (“1”) 4816 inthe summary view, the user navigates to a “Device Anomalies” view 4815in FIG. 48C, analogous to the “User Anomalies” view 4740 in FIG. 47E. Inthis example, there are no threats associated with the device. If,however, there is an associated threat, then upon clicking on the“Threats” number in the summary view 4810, the user will navigate to a“Device Threats” view, analogous to the “User Threats” view describedpreviously.

The Users Table view 4709 can additionally include a user profile box4720 indicating, for example, the user's HR (human resources) status,Department in the organization (e.g., “Sales”), email address, login ID,Phone number, Address, and AD groups. The profile box may also includeinformation concerning Similar Users, Top Devices, and Top Apps. As alsoshown in FIG. 9C, the Users Table view may also include a User EventsTrend box 4721, which depicts how many events that the user participatedin over a time period. A sudden increase in the number of events can beuseful in evaluating potential network compromise. As yet anotherexample, the Users Table view can provide a User Events Classes box4722, which shows the number of each class of events for which the userwas a participant.

Returning once again to FIG. 39B, by selecting the “Applications” toggle3910 in the “Views” tab 3902, the GUI user navigates to an “ApplicationsTable” view 4900 as illustrated in FIG. 49A. Analogous to the “UsersTable” and “Devices Table” described above, the “Applications Table”provides a list of each application that is associated with a threat oranomaly. The listing can include the application name, the number ofassociated anomalies, the number of associated threats, the date and/ortime of the most recent update, and the score associated with theapplication.

By clicking on an entry in the “Apps Table” view, such as “ssh,” the GUInavigates to the “App Facts” view 4910 for that selected application asshown in FIG. 49B. The “App Facts” view can include a summary sectionand other information, such as an “App Score Trend,” “App ActivitiesBaseline,” and “App Graph,” which are analogous to graphs and chartsdescribed previously with reference to the “User Facts” and “DeviceFacts” views. As with the “User Facts” and “Device Facts” table, a“Watchlist” tab is provided.

Returning to the “Threats Table” view 4500 in FIG. 45A, the GUI asintroduced here additionally includes a selector from the “ThreatsTable” that, upon selection, generates the display of a geographicalrepresentation of the identified threats. Referring to FIG. 50A, byselecting the globe icon 5010, the GUI generates a “Threats Geo Map”5020, as shown in FIG. 50B. The Threats Geo Map depicts, on a globe,each identified threat as a circle on the map at the threat's location.For example, threat 5023 is located in Asia, in or near Thailand, andthere is at least two threats 5022 on the East coast of the UnitedStates. Each circle designating a threat is color-coded according to thescore associated with the threat. For example, threat 5023 may be ayellow color, indicating that the threat is minor (see the referencetable at 5026), whereas threat 5028 (in China) may be orange, indicatingthat the threat is major.

The threats depicted on the Geo Map also may be of different sizes,indicating that number of threats at a particular location. For example,threat 5023 is a small circle, whereas threat 5024 is a larger circle.

By hovering over a threat, such as a threat at 5022, a text bubble willappear, indicating the location and number of threats at that location.Clicking on a threat modifies the text bubble to provide an indicationof the type of threat and a link to “View Threat Details.” Upon clickingon this link, the GUI user navigates to the associated “Threat Details”view, such as the “Threat Details” view 4540 of FIG. 45E.

Another icon 5029 is depicted where the internal network is located.Lines are then shown connecting the internal network location 5029, as ahub, to each threat location. The lines include arrows, indicating thatthe threat is radiating from the internal network hub to othergeographical locations.

Line 5025 is an example of a line connecting the internal hub to athreat. Upon clicking on the line, as shown in FIG. 50D, a text bubbleappears that identifies the one or more anomalies that are associatedwith the threat. The text bubble identifies each type of anomaly bytype, the number of anomalies of each type, and a color-codingindicating the severity of each anomaly. In the example of FIG. 50D, thetext bubble also provides a link by which the user can click to “ViewAll 2 Anomalies.” Upon clicking on this link, the GUI user navigates tothe “Anomalies Table” view, such as the “Anomalies Table” view 4600 asshown in FIG. 46A.

Returning to FIG. 39A, upon selecting the “Analytics” tab 3903, the GUIgenerates an “Analytics Dashboard” 5100 as shown in FIG. 51. Thisdashboard presents several charts and other graphics similar to thoseshown in other figures shown above, including “Threats By Threat Type,”“Anomalies by Anomalies Type,” “Latest Threats,” and “Latest Anomalies.”

XI. Probabilistic Suffix Trees

As discussed above, one of the many features of the security platformintroduced here is the capability of detecting unknown anomalies andthreats. The security platform can achieve this through any of variousmachine learning models. Specifically, a number of these machinelearning models can be adapted to perform security-related analysis,including behavioral analysis for specific entities (e.g., a user, amachine, a group of user or machines). Using the techniques discussedherein, machine learning models can establish behavioral baselines forvarious different entities of various different types (e.g., users,devices, etc.) and can detect behavioral deviations from such baselinesas potentially indicative of malicious activities. In addition, thesecurity platform provides a structure for the network administrators orsecurity analysts to easily design, configure, and/or modify the modelsin order to suit their own purposes and the deployed environment.

Many traditional techniques only focus on detecting security breaches ona per event basis (e.g., inspecting each event according to rules orsignature comparison to determine whether any single event ismalicious), and these traditional techniques would not be able to detectany security-related issue if each of the events considered individuallyappears to be normal. To address this problem, a number of examplemodels (e.g., an event sequence prediction model, which may becustomized for detecting abnormal entity behaviors) utilized by thesecurity platform are configured to discover behavioral anomalies bydetermining whether a given sequence of events as associated with anentity deviates from an anticipated behavioral baseline, even thougheach event individually may well be considered not malicious oranomalous. For this purpose, in various implementations of these models,a probabilistic suffix tree (PST) based data processing procedure can beemployed.

The PST based data processing procedure can utilize a “windowed” versionof a probabilistic suffix tree to detect an unusual sequence (e.g.,event sequence). As used herein, a sequence can by any timely orderedsequence of arbitrary symbols. In practical implementations, thesesymbols can denote particular types of security events including, forexample, Connection-Fail, Password-Rest, or File-Access. In severalembodiments, each symbol discussed herein is an event feature set asdiscussed in this disclosure. A symbol can correspond to at least amachine-observed event. However, note that the PST based data processingprocedure described here is generally applicable to any type ofsequence, not limited to those that are disclosed herein. To facilitatediscussion, in the following context, Event-Types are used as an exampleof the symbols. Further, for simplicity, the Event-Type symbolsdiscussed here may be denoted with single characters (e.g., x, y, z)and/or integers (e.g., 0, 1), which will be made clear by the context.Also, the PST based data processing procedure may be referred to hereinas the PST-based machine learning model or, simply, the PST model.

More specifically, the PST model is to be used in a way that, given anobservation window with a number of previous symbols, the PST model canpredict what the next symbol may be, to identify whether a target windowis anomalous (e.g., by having an anomaly count beyond a baseline).Before the PST model is ready to do so, the PST model needs to receivetraining so that it can more accurately anticipate or predict the nextsymbol. For example, the PST model can be trained by a certain set ofhistorical symbols. This set of historical symbols (i.e., the amount oftraining) denotes whether the PST model is considered ready (i.e., theprediction can be considered enough trustworthy). The amount of trainingcan be controlled based on any of various training principles including,for example, by a fixed time, by a fixed number of symbols, or by othersuitable methods including automatic training. The fixed time type oftraining can include training the PST model by using all previoussymbols that took place within a certain time window (e.g., one week).The fixed symbol number type of training can include training the PSTmodel by using a select number of previous symbols (e.g., 5,000 events).An example of an automatic training can include training the PST modelby using past symbols until the PST model meets a certain criterion,such as convergence. For example, in some embodiments, similar to howthe PST model can score (discussed in more detail below), a vectorcomprised of computed scores from the in-training PST model can be builtand compared to other versions of the PST model to determine if themodel state of the in-training PST model is ready (e.g., is convergingor has converged by a certain degree). Note that, in some applications,the observation window is to be kept at a relatively small size (e.g.,around four to five symbols) in order to keep computational complexityat a reasonable degree. According to some embodiments, a maximum valueof five symbols is used for such observation window. This approach tosequence analysis utilizes the property of the PST that can “memorizehistory.” The sequence generation process of the PST model can bemodeled as a variable length Markov chain, which may be similar to aformation of finite state automaton. The “memory capacity” of the PSTmodel can be controlled by the maximum length of historic symbols, whichis the probabilistic suffix tree's depth, and is the length of theMarkov chain.

After a PST model is trained, it can be used to more reliably predictthe next symbol. Specifically, given a history of a number of symbols(e.g., five symbols), a trained PST model can generate the entireprobability distribution for all “next” symbols for the entire set ofpossible symbols seen for a particular entity. For simplicity, theprobability of a particular next symbol given a particular sequence ofhistorical symbol is denoted as “P(next|history),” which is alsoreferred to herein as “predictions.” For example, if a PST modelgenerates that P(a|aabcd)=0.1, P(b|aabcd)=0.8, P(c|aabcd)=0.1, andP(d|aabcd)=0, it means that, given the history “aabcd,” the probabilityof the next symbol in the sequence being “a” is 10%, “b” is 80%, “c” is10%, and it is highly unlikely to see “d” as the next symbol. In thisway, if the actual next symbol in the sequence is “a”, “b”, or “c,”these symbols may be deemed acceptable or normal because they areacceptably predicted (e.g., because they all have probabilities thatmeet or exceed a certain threshold, for example, 10%).

However, if the actual next symbol that appears is a “d,” then becausethe prediction of the probability of “d” appearing is very low, thisevent/symbol is considered unusual, or rare. Thereafter, in someembodiments, such rare event can trigger an alert to the administratorfor further analysis. As used herein, an unusual symbol (e.g.,representing an event) is the actual occurrence of a symbol when the PSTmodel predicts the probability of such symbol's occurrence is less thana threshold, for example, 0.1% or 0.01%. The threshold can be selectedand/or adjusted by the administrator according to the environment. Anexample of a PST model having been trained by a particular sequence[100111] is shown in FIG. 52. In the PST model shown in FIG. 52, thePST's depth is 3.

In addition, because different types of entities may have differentcharacteristics in their behaviors, to further enhance the accuracy ofbehavioral anomaly detection for a specific entity (e.g., a user),various embodiments of the PST model can be configured to firstestablish a baseline prediction profile (or simply “baseline”) for aspecific entity after the PST model is trained. Specifically, aprofiling window of successive prediction can be used to build thebaseline prediction profile (e.g., for a specific entity, to learn thathow many unusual events per window for the specific entity is considernormal).

In some implementations, when the PST model is ready (i.e., has beensufficiently trained), the results of the PST model's next symbolpredictions within a profiling window can be recorded. Some embodimentsprovide that the profiling window has a fixed length. With thisadditional layer of baseline prediction profile, the PST model canbecome more robust against the potential noise from the presence of afew unusual events, thereby less likely to trigger a false alarm. Inother words, if it is actually normal for a certain type of entity(e.g., an administrative user) to have a certain number of unusualsymbol predictions within a profiling window, then the PST model canlearn this by the baseline prediction profile, reducing the probabilitythat the PST model triggers a false alarm in those normal and commoncases. For simplicity, a profiling window can be denoted as “W,” and thelength of a profiling window can be denoted as W. An example timeline5300 is shown in FIG. 53, illustrating the training of a probabilisticsuffix tree based model, the establishment of a baseline predictionprofile, and the activation of a particular model version.

In certain embodiments, the properties of a profiling window can beeasily changed or tweaked. Different variations of the profiling windowcan also be used by a PST model to suit different purposes. In a numberof implementations, a profiling window can be evaluated based on a counton the ratio, R, of the number of predictions that are below a threshold(e.g., 0.01%) inside the profiling window to the length of the window.This R can also be referred to as the rarity score. For example, ifinside a given profiling window of length 10, there are 4 predictionsthat are below 0.01%, then the ratio R of unusual events in thatprofiling window is 4/10 (or R=0.4). In some implementations, toestablish the baseline prediction profile using the profiling windowtechnique is to learn what a usual R is for a particular user.

In order to do so, in some embodiments, after the PST model becomesready, the predictions (of the occurrence of unusual events) inside eachprofiling window during a certain time length are collected, by slidinga profiling window through the certain time length. This time length isdenoted as the baseline prediction profiling phase on FIG. 53. Then, ahistogram can be made to record all the ratios that are observed. Thishistogram essentially records the usual R for a particular user.Specifically, the collecting of the predictions from each profilingwindow can be repeatedly performed for a period of time (i.e., “slidingthrough” the period of time). This period of time may be N times thelength of the profiling window (i.e., N×|W|). In some examples, N is 10.During the baseline prediction profile establishment (shown in FIG. 53),for a period of time after the PST model becomes ready, the R for eachprofiling window is tracked and stored in a histogram. This learnedhistogram can be denoted as “H.” With this histogram built for thespecific entity, for any new R, the PST model can produce a P(R|H). TheP(R|H) is the probability of seeing a window with a ratio R, given thehistory of previous Rs. In this manner, a baseline prediction profilefor a specific entity can be built.

After the histogram is built, the PST model can be activated to detectanomalies for the specific entity. This can also be referred to as thescoring phase. To detect an anomaly (e.g., an abnormal behavior of aspecific entity as exhibited by a sequence of events), oneimplementation is to first make record of the rare sequence for theparticular entity. Specifically, after the PST model is activated, atarget window can be used by the PST model to identify the raresequence. Similar to the scoring process for the profiling window duringthe baseline prediction profiling phase, the PST model can be used togenerate predictions and calculate the ratio R for a given target windowin order to score the target window. For better prediction accuracy, thesize of the target window can be set to the same size as the profilingwindow. After generating an R for a target window, the PST model thenrefers to the histogram to find the probability of encountering suchwindow with at least an R of this level. If this probability (i.e.,P(R|H)) is lower than a certain threshold (e.g., <0.5%), then the PSTmodel determines that this particular target window is anomalous (i.e.,for having a rare sequence for the particular entity), and that thisanomalous window needs to be recorded (e.g., in a database of rarewindows, described below) and/or flagged as anomalous.

Furthermore, in a number of implementations, an anomalous windowexpansion technique can be used to more fully capture the anomalousactivity. In some of these implementations, when a target window has anR that has low enough probability, a window collection process isinitiated. The purpose of the anomalous window expansion technique is toexpand the window of unusual activity with the attempt to include asmany related unusual actions of the entity inside a single window aspossible. One example of the technique allows the original target window(e.g., which is of a fixed length, such as |W|) to be expanded up to acertain size when such target window is found to be anomalous. Notethat, however, the longer the window can expand, the larger the requiredmemory is to accommodate such expansion. The expanded window can bedenoted as “E,” where |E| is equal to or greater than |W|.

In at least one example, to achieve this suspicion window expansion,upon the detection of an unusual R in a target window, the PST model canfix the start point of that target window and start increasing thewindow's size (e.g., by one window) each time it is determined that thenext target window also has an R score that is below or equal to the Rthat triggered the anomalous window expansion process (or until themaximum expansion size is reached). When a next window with a normal Rappears, the collection process of the anomalous window can stop.

Then, in certain embodiments, the aforementioned collected anomalouswindow can be compared with a database of rare windows. Specifically, inthese embodiments, a database of rare windows (also referred to here asrare window cache) can be maintained to keep record of rare windows thatthe system have seen in the past. Each time there is a new rare window,this database can be referenced to check if there has been any “similar”rare window in the past, and if so, how many. The rationale for thisrare window cache technique is the observation that a rare window thathas been observed many times in the past tends to be less “anomalous”than a rare window of activity that does not appear to be similar toanything that has been observed before. This technique can be useful insome instances, for example, to discover whether a shared account (e.g.,root) may be stolen.

Specifically, for a given sequence, in order to determine whether thesystem have seen any similar sequence before, the PST model is capableof comparing two sequences with each other. There are many known methodsto compare sequences and determine similarity. Nonetheless, disclosedhere is a particular way that can be used to compare the similarity,namely, by using a combination of two metrics, the cosine similarity andthe Jaccard similarity.

PST-SIM: The PST implementation of cosine similarity (PST-SIM) is thecosine similarity between two vectors representing the two sequences.Each vector is comprised of the probabilities learned by training anisolated PST for each sequences (more details on building a vector for asequence are discussed below). This PST-SIM metric can be useful tocapture the similarity between the frequent subsequences of the twosequences.

JAC-SIM: The PST implementation of the Jaccard similarity (also known asthe Jaccard index) is the Jaccard similarity between the symbols in thetwo sequences. It can be defined as JAC-SIM(A, B)=|A intersection B|/|Aunion B|. This JAC-SIM metric gives more weight to the presence of fewdifferent symbols, and it does not take into consideration the symbols'appearance frequencies or their order.

Because it is observed that these two metrics have different goals, someembodiments employ a combination of two metrics. In particular, thePST-SIM puts emphasis on a bigger, overall picture of the symboldistribution and evaluates how similar the distributions are. On theother hand, the JAC-SIM is more sensitive to the presence or absence ofsymbols between two sequences. In other words, the more new symbolsthere is in one sequence as compared to the other, the more differentthe JAC-SIM result becomes. Conversely, if only a few symbols aremissing, and the remaining common symbols appear in the same or similarmanner in both sequences, then the PST-SIM result typically is not veryaffected by the few missing symbols. In some embodiments, the similaritybetween two sequences is calculated by Sim(S1, S2)=0.5×PST-SIM(S1,S2)+0.5×JAC-SIM(S1, S2).

In some occasions, such as those described above (e.g., to see whether aPST trainee has started to converge to another PST, or to perform thePST-SIM comparison), two PSTs need to be compared. A PST (e.g., in a PSTmodel, shown in FIG. 52) contains the conditional and marginalprobabilities of all the symbols used in the training. Therefore, oneway to compare two PSTs is to vectorize the two PSTs, and compare theircorresponding probabilities (both marginal and conditional) one by one.After vectorizing the PSTs, resulting in two probability vectors, asuitable vector similarity metric (e.g., Euclidian distance, or cosinesimilarity) can be used to compare the two PSTs.

Consider an example with three possible symbols, {x,y,z}, and a PST ofdepth 2 (meaning that the PST model at most looks at two historicalsymbols to predict the next one). Further, in this example, assume thatthe marginal probabilities are P(x)=0.8, P(y)=0.15, and P(z)=0.05, andthe conditional probabilities are P(x|xx)=0.7, P(y|xx)=0.3, P(z|y)=1.0,and so forth. Then, for two sequences A and B, Table 1 is an example oftwo probability vectors of the PSTs for the two sequences.

TABLE 1 P(x) P(y) P(z) P(x|xx) P(y|xx) P(z|y) . . . PST-A 0.8 0.15 0.050.7 0.3 1 . . . PST-B 0.6 0.4 0 1 0.4 0.8 . . .

Note that, in some embodiments, for each rare sequence, only this PSTsummary of the rare sequence (i.e., vectorized PST) is kept in the rarewindow cache. Because the PST summary of the sequence includes all theprobability information, the PST summary can be treated as a rare windowsignature. The PST summary, representing a rare sequence, can be used tocompare with another sequence, for example, by using a combination ofthe PST-SIM and the JAC-SIM. In addition, for each rare window, the rarewindow cache keeps a record of how many times the rare window has beenobserved and, in some embodiments, for how many distinct days. In thisway, when a new rare window is observed, the PST model can check therare window cache to determine whether the new rare window has appearedbefore, and if affirmative, for how many times and over how manydifferent days. This information can be useful for deciding if the newrare window is worth raising an alarm or not.

With all the above in mind, FIG. 54A shows an example of how a normalbehavioral sequence may be represented in a probabilistic suffix treebased model, and FIG. 54B shows an example of how an unusual behavioralsequence may be discovered in a probabilistic suffix tree based model.As can been seen from these two figures, the PST model can be verypowerful to distinguish abnormal behaviors from normal behaviors, evenin an complex network environment with many users collaborating.

FIG. 55A through FIG. 58 show example graphical user interface (GUI)display screens of how an unusual behavioral sequence discovered can bepresented to an administrator for actions and/or feedbacks. When ananomaly is discovered, the result can be presented to a user via a userinterface, such as a GUI. As illustrated in FIG. 55A, the user interfacecan include textual description, such as which user has an unusualwindow, what kind of unusual sequence it is (e.g., Active Directory),how many events are in the window, how long the window has lasted, andso on. As illustrated in FIG. 55B, additional information about the usercan be presented in the user interface, such as information about thetraining of the model for the user. Further, as illustrated in FIG. 56,results from comparing the marginal of the events for the anomalouswindow and the entire data for the user (e.g., baseline) can beautomatically shown (e.g., in diagrams).

Further, as an option, all the “unusual” PST predictions thatcontributed to the high R can be shown to the administrator, and in someembodiments, can be shown as a timeline of unusual sequences.Illustrated in FIG. 57 is an overview of all the unusual sequence, shownas a timeline. Then, the administrator can interact with (e.g., clickon) each timeline event and expand on the unusual sequence of eventsthat lead to the low PST prediction, such as shown in FIG. 58.

In the above described manner, the PST model can enable the securityplatform to discover behavioral anomalies by determining whether a givensequence of events as associated with an entity deviates from angenerally anticipated behavioral baseline, even though each eventindividually may well be considered not malicious. Also, the securityplatform provides intuitive ways for the administrator to receive alertand to understand relevant information in order to make an educateddecision.

XII. Clustering on Graphs

In a network security context it may be advantageous to identifyclusters of nodes (“node clusters” or “clusters”) in a graph, such as inthe above-mentioned composite relationship graph or a projection of it.Doing so may be advantageous for various reasons, such as detectingsimilarities between users or devices and/or detecting deviations in anentity's activity from a behavioral baseline. For example,identification of node clusters can facilitate detection of lateralmovement by user (e.g., a user accessing a device that he does notnormally access) or detection of an account takeover situation.

For example, the system may initially determine that a particular entityis a member of a particular node cluster, or that the entity normallyinteracts with an entity that is a member of the node cluster. A clustermay represent a group of users who all tend to access the same set ofdevices on the network, for example. Subsequently a decision engine maydetect that the particular user in that group has engaged in activitythat represents a divergence from the identified cluster, such as a userin the cluster accessing a device that is not among those normallyaccessed by users in his cluster. In response to detecting thisdivergence, the decision engine can determine that the user's activityrepresents an anomaly, or perhaps even a threat.

What follows is a description of efficient, highly scalable, andparallelizable technique for identifying node clusters in a graph. Thetechnique can be implemented by one or more of the above-mentionedmachine learning models, for example, and can be implemented in thereal-time path, the batch path, or both.

Briefly stated, in the cluster identification technique introduced here,an automated cluster identification process (e.g., from logic of amachine learning model) computes L1-norm values for the nodes in a graphto assign positions to the nodes on a one-dimensional (1D) grid. Theprocess then identifies one or more node clusters in the graph based onthe assigned positions of the nodes on the 1D grid. More specifically,the process creates node groups by iteratively relocating nodes on the1D grid to positions where the L1-norm for each node is minimum. Afterfinding optimal positions for the nodes on the 1D grid in this manner,each group of nodes located at the same position on the 1D grid (if any)represents a cluster.

The technique is now further described with reference to FIGS. 59through 62. FIG. 59 is a flowchart showing an example of theabove-mentioned process. The initial input to the process is any graph,an example of which is shown as graph 6101 in FIG. 61A. In otherembodiments, the process of FIG. 59 may be performed while a graph isbeing constructed. It is assumed that edge weights are represented byintegers, not floating point numbers, and that multiple associationsbetween nodes are collapsed into the weight of a single edge afterproper boosting/weighting.

At step 5901 in FIG. 59, the process initially traverses the graph nodeby node and maps the nodes onto a one-dimensional (1D) grid. The graphmay be traversed in any order. For example, a breadth first search (BFS)order may be convenient. An example of a 1D grid resulting fromtraversing graph 6101 in BFS order is shown as grid 6102 in FIG. 61A. InFIG. 61A, the numeral inside each node (circle) indicates the order inwhich the node has been “touched” during a BFS traversal and, hence, itsposition in the 1D grid 6102. Therefore, to facilitate description, thenodes of graph 6101 are referred to by their positions in the 1D grid6102, e.g., Node 1, Node 2, etc., corresponding respectively topositions 1, 2, etc.

After mapping the nodes to the 1D grid, the process at step 5902 createsgroups of nodes that have the same position on the 1D grid, byiteratively minimizing the L1-norm of each node to find its “optimal”position on the 1D grid. A “norm” in this context is a function thatassigns a strictly positive length or size to each vector in a vectorspace (except the zero vector, which is assigned a length of zero). anL1-norm, at least in the context of this description, is the sum of theindividual distances (absolute) along the 1D grid between each candidateposition for a node under consideration and each other candidateposition for the node under consideration. The candidate positions arethe positions of all nodes directly connected to the node underconsideration in the graph. The “optimal” position for a node underconsideration is the position of that node, in the 1D grid, where thenode's L1-norm is minimum.

Referring to the example of FIGS. 61A and 61B, therefore, after mappingall the nodes to the 1D grid 6102, the process will initially attempt todetermine the optimal position for Node 1. To do so, the processcomputes the L1-norm for Node 1 in each of its candidate positions. Node1 is directly connected to Nodes 2, 5 and 6 in the graph 6101 (i.e., thenodes that occupy positions 2, 5 and 6 and the 1D grid). Therefore, thecandidate positions for Node 1 are the positions occupied by Nodes 2, 5and 6 on grid 6102. Therefore, the process computes the L1-norm for Node1 each of those candidate positions, and chooses the position at whichthe L1-norm is smallest as the optimal position for Node 1. If Node 1were maintained at its initial position on the 1D grid, its L1-normwould be computed as the sum of the absolute distances, along the 1Dgrid, between position 1 and positions 2, 5 and 6 on grid 6202, i.e.,the L1-norm of Node 1 at position 1 isL1-Norm_(1,1)=|1−2|+|1−5|+1−6|=10. In contrast, if Node 1 were to bemoved to the position of Node 5 on the 1D grid, the L1-norm of Node 1 atposition 5 would be computed as L1−Norm_(1,5)=|5−2|+|5−5|+5−6|=4.

As can be easily verified, the L1-norm of Node 1 is minimum at position5 on grid 6102 in the example of FIGS. 61A and 61B. Therefore, theposition of Node 5 is deemed to be the optimal position of Node 1 in theinitial iteration, so Node 1 is moved to the position of Node 5, asshown in FIG. 61B. Note that a node's optimal position can change insubsequent iterations, however, as the node and/or other nodes may berelocated along the 1D grid.

After processing all of the nodes of the graph in this manner in step5902, one or more nodes may occupy the same position on the 1D grid;such nodes are considered to constitute a node group, which may be acluster. However, before concluding that a node group is in fact acluster, the process looks for any node(s) in each node group that havea stronger connection to nodes outside their group; such nodes should beremoved from their current group (i.e., relocated along the 1D grid).

Referring back to FIG. 59, therefore, in step 5903 the process detectsthe actual clusters in each group based on the internal-to-external edgeratios of the nodes. In this context, a node can have one or more“internal” edges and one or more “external” edges. An internal edge isany edge that connects the node to another node within the same nodegroup (created in step 5902), whereas an external edge is any edge thatconnects a node to another node outside its node group. If any node hasexternal edges whose summed weight exceeds the summed weight of all ofits internal edges (i.e., its internal/external edge ratio is less thanone), then at step 5904 removes that node from its current node group byshifting the node one position to the left or right along the 1D grid(the direction does not matter). Each node relocated in this manner iscalled a “floater.” Hence, if at step 5905 there are any floaters, theprocess proceeds to 5907, in which the process iterates through all ofthe floater nodes and merges them with the existing cluster(s). If thereare no floaters at step 5905, the process proceeds to step 5906, inwhich it outputs the identified clusters (e.g., to another machinelearning model, a decision engine, a user interface, etc.).

FIG. 61B also shows, at the bottom, the positions of all of the nodesafter three iterations. It can be seen that three clusters have beenidentified: Nodes 1 through 6; Nodes 7 through 11; and Nodes 12 through14.

In addition to being efficient, highly scalable and parallelizable, thisprocess is also incremental, which means if a single node or multiplenodes are added to the graph, it is not necessary to remap the entire(modified) graph onto the 1D grid; instead each newly added node of thegraph can be inserted directly into the 1D grid by minimizing itsL1-norm as described above.

The above-described cluster identification technique can be used toidentify clusters in essentially any kind of graph. A special case ofsuch a graph, however, is a bipartite graph. A bipartite graph is agraph whose nodes can be divided into two disjoint sets, called normalnodes and pseudo-nodes (i.e., normal nodes and pseudo-nodes are eachindependent sets), such that every edge connects a normal node to apseudo-node. For example, a bipartite graph may be created in which thenormal nodes represent users and the pseudo-nodes represent devicesaccessed by those users. Such a graph can be used, for example, tofacilitate detection of lateral movement by users. An implementation ofthe above-described technique can be applied to detect clusters in abipartite graph, as discussed further in a section below. An example ofsuch an implementation for bipartite graphs is illustrated in FIGS. 60Aand 60B, with a corresponding example of a use case illustrated in FIG.62.

Referring first to FIG. 60A, at step 6001 the process initiallytraverses the bipartite graph and maps only the normal nodes onto a 1Dgrid. The graph may be traversed in any order, such as BFS order. Next,at step 6002 the process create groups of nodes that occupy the sameposition in 1-D grid, by minimizing the L1-norm of each normal node tofind its optimal position in the 1-D grid. Referring to FIG. 62, thenormal nodes are Nodes 1 through 7 (i.e., the left column of graph 6201)whose positions are the positions on the 1D grid, while the pseudo-nodesare Nodes 8 through 10 (the right column of graph 6201). The process ofminimizing L1-norms for a bipartite graph is described further below.

The process then determines at step 6003 whether any normal nodes weremoved during step 6002. If any normal nodes were moved during step 6002,the process loops back to step 6002 for another iteration. Otherwise,the process outputs the identified cluster(s) (e.g., to another machinelearning model, a decision engine, a user interface, etc.), where acluster is a group of nodes that occupy the same position on the 1Dgrid.

FIG. 60B shows in greater detail the step 6002 of FIG. 60A, i.e., thestep of minimizing the L1-norm values to find optimal positions for thenormal nodes. Initially, at step 6011 the process selects a normal nodeof the graph (the “node under consideration”). The process thenidentifies all of the pseudo-nodes to which the selected normal node isdirectly connected, at step 6012. For example, in graph 6201 of FIG. 62,normal Node 1 is connected only to pseudo-Node 8. The process then, atstep 6013, identifies the minimum and maximum of positions, on the 1Dgrid, of all normal nodes to which the identified pseudo-node(s) is/areconnected.

For example, in step 6013, if (normal) Node 1 were the selected node,then the minimum and maximum positions would be 1 and 2, respectively,since Node 1 is connected only to pseudo-Node 8, which is also connectedto normal Node 2. If Node 6 were the selected node, then the minimum andmaximum positions would be 3 and 7, respectively, since Node 6 isconnected to pseudo-Node 9, which is also connected to normal Nodes 3and 4, and to pseudo-Node 10, which is also connected to normal Nodes 5and 7.

The process next determines at step 6014 the “optimal” position for thenormal node, as the position on the 1D grid that corresponds mostclosely to the midpoint between the minimum and maximum positionsdetermined in step 6013 (rounding up if the exact midpoint falls betweentwo positions on the grid). At step 6015 the process moves the selectednormal node to the position determined in step 6014, with the effectbeing to minimize the selected node's L1-norm. This process repeats foreach normal node until all of the normal nodes have been processed inthis manner, and then returns to the process of FIG. 60A, proceedingthen to step 6003 in FIG. 60A as described above.

As shown in FIG. 62, the process identifies two clusters from theexample graph 6201, namely, Nodes 1 and 2 as one cluster, and Nodes 3through 7 as another cluster. The process of FIGS. 60A and 60B is alsoincremental, such that the addition of a new node or nodes to the graphdoes not require remapping the entire graph onto the 1D grid; rather thenew node(s) can be added directly to the 2D grid as described above.

XIII. Lateral Movement Detection

FIGS. 63 through 67 relate to a method for identifying a security threatbased on detecting suspicious lateral movement of a user. Lateralmovement refers to a user using a device or devices that he or she doesnot normally use, which may be (but is not necessarily) indicative of asecurity threat.

Lateral movement may indicate the possibility that the credential of auser has been stolen, or the user's device has been controlled by amalicious software. For example, a wrongdoer may steal a user'scredential and use the stolen credential to access a device that theuser typically does not access. An analyzer (e.g., the real-timeanalyzer 210 or the batch analyzer 240 in FIG. 3) may recognize such anevent as an anomaly. Furthermore, if the analyzer detects that theanomaly (directly or through other anomalies) leads to a result that thewrongdoer (disguised as a legitimate user) gains access to a devicedesignated as a critical resource, the analyzer can recognize a securitythreat represented by a set of the relevant anomalies.

The lateral movement detection method introduced here assigns similarityscores to devices in a computer network based on the relationshipsbetween users and the devices. For example, the relationships caninclude information regarding certain users logging into devices. Thesimilarity scores suggest the similarities between the devices in termsof associated users. The method further generates or identifiesclassification metadata of the user and the device, based on event dataabout the login event, to further explain the relevance of the user andthe device in a security context. The method then detects an anomalybased on the classification metadata and similarity scores when a userinteracts with a device having a similarity score that is significantlydifferent from the similarity scores of devices with which the userusually interacts. Based on the detected anomaly, the method may furtherdetermine a security threat based on the relationship information byidentifying, in a relationship graph, a relationship path from a userthrough anomalies to a critical resource.

In some embodiments, the method described here can be implemented by amachine learning model. For example, processing logic of a machinelearning mode can generate the classification metadata, or assign usagesimilarity scores, or both, as further described below.

In some embodiments, the processes of generating the classificationmetadata and/or assigning usage similarity scores are performed inreal-time as the event data are received. In other embodiments, eitheror both of these processes are performed in batch mode based on eventdata stored in a non-volatile storage facility.

FIG. 63 is a block diagram illustrating a machine learning model thatdetects lateral movement in a computer network. The computer networkincludes entities, such as devices and network devices. The machinelearning model 6300 analyzes event data 6310. The event data 6310 canbe, e.g., timestamped machine data. The event data 6310 includeinformation regarding the computer network activities of the users andnetwork devices. In one embodiment, the event data 6310 includes aprojection of the security graph. The particular projection of thesecurity graph (also referred to as “login projection” or “login graph”)records the information that relates to login events in which the userslog into the network devices in the computer network.

Based on the event data 6310 (e.g., the login graph), the machinelearning model 6300 generates classification metadata 6320 for each ofthe network devices and for each of the users. The classificationmetadata 6320 helps explain the relevance in a network security contextof each of the users and each of the network devices. For example, theclassification metadata 6320 for a particular user can include metadataindicative that the user is a regular user, an administrative user, oran automated (machine-implemented) user, for example. Similarly theclassification metadata 6320 for a particular network device can includemetadata indicative that the particular network device is a workstation,a server or a printer, for example.

Because the classification metadata 6320 are generated based on theevent data 6310, the machine learning model 6300 does not needadditional metadata that explicitly annotates the types of the user andnetwork devices. The machine learning model 6300 can automaticallyrecognize the types of the users and network devices, based on the eventdata representing the network activities involving the users and networkdevices.

The machine learning model 6300 further identifies usage relationships6330 between the users and the network devices based on the event data6310. For example, if the event data 6310 includes a login graph havinginformation that relates to the login events, the machine learning model6300 can identify the usage relationships 6330 as login eventsindicative of the users logging into the network devices. In someembodiments, the usage relationship 6330 can be presented as a graphhaving nodes and edges interconnecting the nodes, as illustrated in FIG.63. The nodes represent network entities such as users and networkdevices, and the edges represent the login events that the users loginto the network devices.

As shown in FIG. 63, the usage relationships 6330 between the users andthe network devices can be captured in a bipartite graph including afirst set of nodes representing users (nodes 6341, 6342, 6343 and 6344)and a second set of nodes representing network devices (nodes 6351,6352, 6353 and 6354). The first and second sets are disjoint sets. Everyedge in the bipartite graph connects a user node in the first set to adevice node in the second set. In addition, the relationships 6330between the user nodes and the device nodes also represent a time seriesof events in which the users have interacted (e.g., logged in) with thenetwork devices.

Based on the usage relationships 6330, the machine learning model 6300assigns usage similarity scores 6360 (also referred to as “similarityscores”) to the network devices represented by the device nodes. Theusage similarity scores 6360 indicate which of the devices have beenused by the same or similar group of users. The details of the processof assigning usage similarity scores 6360 are illustrated in FIG. 65.

The similarity scores are assigned such that any given set of networkdevices that are accessed by the same or similar group of users areassigned similarity scores that are closer in value to each other thanthe similarity scores of any other set of network devices that are notaccessed by the same or similar group of users. In other words, a groupof network devices that have similar groups of login users tend to havesimilarity scores that are closer in value to each other than similarityscores of network devices that do not have similar groups of loginusers.

FIG. 64 illustrates an example of a bipartite graph showing events ofusers logging into network devices. The bipartite graph 6400 includes agroup of user nodes 6411, 6412, 6413 and 6414, and a group of devicenodes 6421, 6422, 6423 and 6424. The edges between the user nodes anddevice nodes represent the login activities. To facilitate discussion,the reference numerals in FIG. 64 are used interchangeably to refer tothe nodes and the users or network devices represented by those nodes.

As shown in FIG. 64, two users 6411 and 6413 have logged into device6421. Two users 6411 and 6412 have logged into device 6422. Two users412 and 6413 have logged into the device 6423. Therefore, devices 6421,6422 and 6423 are associated with a similar groups of users, i.e., users6411, 6412 and 6413.

In contrast, before user 6412 logs into device 6424, wherein the dashedline represents that particular login activity, only user 6414 haslogged into device 6424. The group of user(s) that has/have logged intodevice 6424 is substantially different from the groups of users thathave logged into devices 6421, 6422 and 6423. This difference isreflected in the similarity scores assigned to devices 6421, 6422, 6423and 6424. Devices 6421, 6422 and 6423 have similar (numerically close)similarity scores of 0.31, 0.30 and 0.33, respectively. On the otherhand, device 6424 has a similarity score of 0.06, which is significantlydifferent from the similarity scores of devices 6421, 6422 and 6423.

Once the user 6412 logs into device 6424 (as represented by the dashedline in FIG. 64), the machine learning model 6300 determines thesimilarity score of the particular device 6424 (i.e., 0.06 for device6424) fails to satisfy a specific closeness criterion relative tosimilarity scores of network devices with which the particular userusually interacts (i.e., 0.30 for device 6422 and 0.33 for device 6423).The closeness criterion can be of various different types in differentembodiments. For example, the machine learning device 6300 may determinethat the difference between the similarity score of the particularnetwork device 6424 and an average of the similarity scores for networkdevices 6422 and 6423 is 0.255, which exceeds a threshold of 0.2. Themachine learning model 6300 then detects an anomaly because thedifference of similarity scores exceeds the threshold value.

In an alternative embodiment, the machine learning model 6300 canfurther calculate an anomaly score for the particular user and decidewhether anomaly is detected based on the anomaly score. The anomalyscore indicates a likelihood that the anomaly relates to a securitythreat. The anomaly score can be calculated based on, for example, thedifference between a similarity score of the particular network deviceand a statistical measure (e.g., an average) of similarity scores ofother devices with which the user has interacted. The machine learningmodel 6300 then detects the anomaly if the model determines that theanomaly score exceeds a threshold value for anomaly scores.

For example, the similarity score of the network device 6424 is 0.06,and the average similarity score of network devices 6422 and 6423 is0.315. The difference between the similarity scores is 0.255. Themachine learning model calculates the anomaly score as, e.g., 0.355, bysumming the similarity score difference of 0.255 and an extra weight of0.1 in recognition that the network device 6424 is a server of highimportance. Because the anomaly score of 0.355 exceeds a threshold of0.3, the machine learning model 6300 detects an anomaly.

Alternatively, the machine learning model 6300 can detect an anomalybased on an access profile of a particular user. The access profile ofthe particular user includes network devices with which the particularuser interacts and that have similarity scores that satisfy a specificcloseness criterion. For example, the differences of the similarityscores of network devices 6422 and 6423 within the access profile ofuser 6412 is 0.03 and is less than a threshold value of 0.1. In someembodiments, the access profile of the particular user 6412 can furtherinclude, e.g., information of events indicative that the particular usersucceeded logging in to a network device, failed logging in to a networkdevice, succeeded validating credential of a network device, failedvalidating credential of a network device, succeeded accessing a networkobject stored on a network device, or failed in accessing a networkobject stored on a network device.

When the user 6412 interacts with a particular network device 6424, themachine learning model 6300 calculates the anomaly score for theparticular user based on a difference between the similarity score ofthe particular network device 6424 and the average of similarity scoresof network devices 6422 and 6423 in the access profile of the particularuser 6412. The machine learning model 6300 detects the anomaly if thesimilarity score difference indicates that the particular user 6412 hasinteracted with the particular network device 6424 outside of the accessprofile of the particular user 6412.

The machine learning model 6300 can assign similarity scores to thenetwork devices in various ways. FIG. 65 illustrates an example of aprocess of assigning similarity scores to network devices. At step A inFIG. 65, the machine learning model 6300 receives a bipartite graph. Thebipartite graph includes a group of nodes U1-U6 representing users (alsoreferred to as “user nodes”) and another group of nodes D1-D6representing network devices (also referred to as “device nodes”). Thebipartite graph further includes edges interconnecting the nodes. Theedges represent the relationships between the users and the networkdevices. The machine learning model 6300 selects a device node D4 andassigns an initial weight value of 1 to the selected device node D4. Insome embodiments, the machine learning model 6300 can, e.g., select thedevice node in a random manner. The initial weight value can also have avalue different from 1.

At step B in FIG. 65, the machine learning model 6300 keeps a percentage(15%) of the initial weight value of 1 at the device node D4, andequally distributes a remainder of the initial weight value 1 from thedevice node D4 along the edges of D4 to nodes U2, U3 and U6. In someembodiments, the machine learning model decides the percentage of 15%before starting the similarity score assignment process.

The value distribution process can be viewed as a Markov chain process.At each step, the value distributor(s) have a probability of 15% (hencethe percentage is also referred to as “probability percentage”) toremain at the same node as in the previous step; the valuedistributor(s) have a probability of (100%−15%=85%) to follow an edge ofthe node to move to another node. In some other embodiments, thesimilarity score assignment process can use a percentage other than 15%.

As show in step C of FIG. 65 after the distribution, the machinelearning model 6300 keeps a weight value of 0.15 (=1*15%) at the devicenode D4. The machine learning model 6300 equally distributes a remainderof the initial weight value (0.85=1*0.85%) to user nodes U2, U3 and U6.Each node of user nodes U2, U3 and U6 receives a weight value of 0.283(=0.85/3).

For each node, the machine learning model 6300 repeats the process ofdistributing along edges until the weight values at the network devicesD1-D6 converge. The step D in FIG. 65 shows the next step in theiterative process. For device node D4, the machine learning model 6300keeps a weight value of 0.023 (=0.15*15%) at device node D4, anddistributes 0.042 (=(0.15*85%)/3) to each of user nodes U2, U3 and U6.For user node U2, the machine learning model 6300 keeps a weight valueof 0.042 (=0.283*15%) at user node U2, and distributes 0.120(=(0.283*85%)/2) to each of device nodes D1 and D4.

Similarly, for user node U3, the machine learning model 6300 keeps aweight value of 0.042 (=0.283*15%) at user node U3, and distributes0.241 (=(0.283*85%)/1) to device D4. For user node U6, the machinelearning model 6300 keeps a weight value of 0.042 (=0.283*15%) at usernode U6, and distributes 0.120 (=(0.283*85%)/2) to each of device nodesD4 and D6.

The machine learning model 6300 continues the iterative process untilthe weight values at the network devices D1-D6 converge. At each step ofthe iterative process, for each node, the machine learning model 6300keeps 15% of the weight value at the node and then equally distributesthe remainder of the weight values along the edges to other nodes. Theconvergence criterion can be any criterion indicative of this type ofconvergence. For example, the machine learning model 6300 can determinethat the iterative process reaches a convergence when the change ofweight values between two consecutive steps at each node is less than athreshold value.

Step Z of FIG. 65 shows the status of a final step with converged weightvalues when the iterative process reaches a convergence. The convergedweight values at the devices D1-D6 are similarity scores assigned tothese devices. The machine learning model 6300 uses the similarityscores to determine whether multiple network devices are similar interms of associated users that interact with the devices.

FIGS. 66A through 66D illustrates examples of bipartite graphs that themachine learning model 6300 uses to determine whether network devicesare similar in terms of interacting users. In FIG. 66A, the networkdevices 6610 and 6611 have many shared users (6615, 6616, 6618 and 6619)and therefore tend to have similarity scores close to each other.

In FIG. 66B, the network devices 6620 and 6621 have multiple sharedexclusive users (6628 and 6629). Exclusive users are users that interactwith the network devices 6620 and 6621 only. The network devices 6620and 6621 thus tend to have similarity scores close to each other. InFIG. 66C, the network devices 6630 and 6631 only have a single shareduser 6637. The network devices 6630 and 6631 thus tend to havesimilarity scores that have a large difference.

In FIG. 66D, the network devices 6641, 6642 and 6643 are associated withsimilar groups of users, including users 6651, 6652, 6653 and 6654. Thenetwork devices 6644, 6645 and 6646 are associated with similar groupsof users, including 6654, 6655 and 6656. If the user 6654 is removedfrom the bipartite group, the devices can be separated into two groupsN1 (6641, 6642 and 6643) and N2 (6644, 6645 and 6646) withoutinteractions between the two groups, based on the user interactions.

User 6654 is the only user that has connected to devices of both groupsN1 and N2. The group N1 of devices 6641, 6642 and 6643 have similarityscores close to each other. The group N2 of devices 6644, 6645 and 6646have similarity scores close to each other. Assuming that user 6654typically interacts with device 6645 from group N2, the access profileof user 6654 includes the group N2 of devices 6644, 6645 and 6646. Theinteraction between the user 6654 and device 6642 from group N1 thentriggers an out-of-group access anomaly, because the similarity score ofdevice 6642 is significantly different from the similarity scores ofdevices 6644, 6645 and 6646 within the access profile of user 6654.

The detected out-of-group anomaly is an indication of a suspiciouslateral movement of a particular user in the network. Based on theanomaly, the machine learning model 6300 can further decide whether theanomaly 6370 leads to a security threat 6380, as illustrated in FIG. 63.FIG. 67 illustrates an example of a data structure for detectingsecurity threats based on the detected out-of-profile anomaly.

The machine learning module 6300 retrieves a graph data structure 6700that records anomalies in the network and the relationships between theanomalies and the users and network devices. The graph data structureincludes nodes interconnected by edges. The nodes represent anomaliesand entities such as users and network devices; while the edgesrepresent relationships between the entities and anomalies.

For example, FIG. 67 shows that the retrieved graph data structure 6700includes user nodes U6701, U6705, U6709 and U6711 and device nodesD6703, D6707, D6708 and D6710. The retrieved graph data structure 6700further includes anomaly nodes A6702, A6704 and A6706. Among the anomalynodes, the anomaly node A6702 represent an out-of-profile anomaly. Inother words, the user represented by user node U6701 has accessed thedevice represented by device node D6703 with which the user does notusually interact.

The retrieved graph data structure 6700 is different from the logingraph that the machine learning module 6300 uses to detect theout-of-profile anomaly. The login graph only records information thatrelates to the login events of the users. In contrast, the retrievedgraph data structure 6700 can include relationships beyond the loginevents and can include anomalies of other types besides out-of-profileanomalies. For example, the retrieved graph data structure 6700 includesanomaly node A6706 representing a blacklist anomaly. The blacklistanomaly indicates that the user U6705 has accessed the network deviceD6707 from a blacklisted IP address.

The retrieved graph data structure 6700 further includes anomaly nodeA6704 representing a beaconing anomaly. The beaconing anomaly indicatesthat the device represented by device node D6703 sends suspiciousbeaconing messages periodically to a user device associated with theuser represented by user node U6705.

The machine learning model 6300 identifies, in the retrieved graph datastructure 6700, a relationship path 6720 that suggests a securitythreat. The relationship path 6720 starts with user node U6701 andanomaly node A6702 that represents the out-of-profile anomaly. Therelationship path 6720 ends with the anomaly node A6706 and device nodeD6707 that represents a device designated as a critical resource. Forexample, the device designated as a critical resource can be, e.g., adomain controller server that responds to security authenticationrequests within the computer network.

The relationship path 6720 includes user nodes and device nodesinterlinked by anomaly nodes A6702, A6704 and A6706. In other words, therelationship path 6720 starts from user U6701 through anomaly nodesA6702, A6704 and A6706 to the device D6707 designated as a criticalresource of the computer network.

The machine learning model 6300 identifies a security threat based onthe relationship path 6720. The security threat is represented by theanomaly nodes A6702, A6704 and A6706 along the relationship path 6720.These anomaly nodes suggest that the security threat is imposed by aseries of anomalies. For example, in one embodiment, the security threatcan indicate that an unauthorized user (invader) has misappropriated acredential of the particular legitimate user to enter the networkthrough device D6703 and breached one or more network devices (D6703,D6707) along the relationship path to access the critical resource ondevice D6707.

When a security threat has been detected, the security platform thenreports the threat to an administrator of the network (e.g., via the GUIfeatures described above) and/or writes the security threat into athreat log for later review by an administrator.

XIV. Malware Detection

Techniques will now be disclosed for detecting anomalies indicative ofthe presence of malware within a computer network based on an analysisof network traffic, including communications between entities (bothinternal and external) associated with the network. Malware is generallyunderstood to be unauthorized software operating on or associated withentities (e.g. devices) within a computer network. In some embodiments,the detection of malware based on analysis of network traffic rests onthe assumption that malware in certain instances leaves an observablefootprint in the traffic. For example, malware operating as part of amalicious command and control infrastructure may periodically transmit abeacon signal to another entity seeking command instructions. Asdescribed in other sections of this specification, the presence ofmalware may be inferred based on detecting any of a set anomalousactivity, such as communications to machine-generated domains,machine-generated communications (e.g., beacons), and communications toblacklisted entities (e.g. users, domains, addresses, etc.).

While any individual inference may have value, reducing false positivesin identifying security threats to the network is desirable. To thatend, embodiments are described here that analyze a range of anomalousbehavior to detect an anomaly indicative of the presence of malware. Insome embodiments anomaly detection occurs in real-time or near real-timeas the event data is received, instead of relying on historical log datato perform batch processing. An example processing engine suitable forhigh rate data processing in real-time is Apache Storm. In otherembodiments the processing engine could be implemented by using ApacheSpark Streaming.

FIG. 68 is a high-level conceptual diagram of an example network trafficscenario that illustrates the above principle. FIG. 68 shows a computernetwork 6810 enclosed by the dotted line. Within computer network 6810are a number of associated internal entities 6820 including, for exampleusers and devices. As used herein, an entity should be broadlyunderstood to include any sort of element or component operating withinor otherwise associated with a computer network. For example, entitiesinclude physical computing devices, virtual computing devices, users,software modules, accounts, identifiers, and addresses. Theidentification of a particular entity or set of entities associated witha particular set of event data can be resolved through a processdescribed elsewhere in this specification. As an illustrative example, amachine generated log entry associated with an event may containinformation associating that event with one or more of a an IP address,a unique identification (UID), uniform resource locator (URL), and userID. In such an example each of these identifiers may be considered adiscrete entity associated with the computer network or two or moreidentifiers maybe associated with the same entity. For example, a staticIP address, MAC address, and UID may all be associated with a physicalcomputing device entity. Similarly multiple user account IDs may beassociated with a single physical user (i.e. a person) of the computernetwork.

Operating outside of computer network 6810 is an external entity 6840that may be associated with a malicious actor. Communications may occurbetween different internal entities 6820, and between internal 6820 andexternal entities 6840, as shown. In some embodiments, an analysis ofthese communications based on received event data, leads to thedetection of anomalies 6880 indicating the presence of malware 6860within the computer network 6810.

A. Malware Communications Detection—Process

FIG. 69 is a high level diagram illustrating an example process 6900 fordetecting an anomaly indicative of malware based on network traffic. Theprocess 6900 begins with receiving event data 6901. Event data 6901 isgenerally understood to include any data related to activity on thecomputer network. Here, because network data traffic activity is aprimary focus, the event data 6901 preferably includes timestampedmachine data such as domain name system (DNS) generated log data,firewall generated log data, or proxy generated log data. In someembodiments, the event data 6901 is associated with a communicationbetween an internal entity within a computer network and an externalentity outside the computer network. In some embodiments, the event data6901 is also associated with communications between internal entitieswithin a computer network. As described in more detail elsewhere in thisspecification, in some embodiments, event data 6901 is received from adata intake and preparation stage, which may include an ETL pipeline.

In some embodiments, the process of receiving event data 6901 includesadaptively filtering the event data according to a dynamic whitelist atprocess 6902. This is in contrast with static filtering, for exampleaccording to a static whitelist, to filter out communications toentities known to be benign. Here, adaptive filtering can be applied tofilter out event data associated with more common or more popularnetwork traffic given a particular context. In some embodiments,popularity metrics are defined based on an analysis of network trafficacross the entire network or across a particular subgroup within thenetwork. For example, while domain xyz.com may not be known to bebenign, an analysis of the network traffic can uncover that a highpercentage of users on the network regularly connect to xyz.com.Accordingly, it can be inferred that xyz.com is benign and that it isnot worth the processing effort to analyze the domain for malwareassociations. Note that this process of adaptively filtering thereceived event data is not necessary to the overall anomaly detectionprocess, however it can streamline computational processing, which aidsin detecting anomalies in real-time or near real-time. The filteringalso helps to reduce the number of false positives.

Process 6900 continues with generating a plurality of feature scores byprocessing the filtered event data 6903 or unfiltered event data 6901(collectively referred to herein as event data 6901) as shown at featurescore generation 6920, and generating an entity profile associated withat an entity (internal or external) that includes a plurality ofgenerated feature scores as shown at entity profile generation 6904. Asshown in FIG. 69, feature score generation 6920 includes generation of aplurality of feature scores, each of the plurality of feature scoresgenerated by a different one of various different analyses of the eventdata. For example, feature score generation can include timing analysis6906, lexical analysis 6908, communications statistics 6910, sequencinganalysis 6912, entity associations analysis 6914, referrals analysis6916, and various other types of analysis 6918.

In an embodiment, one or more feature scores for a particular entity aregenerated based on each above-mentioned category of analysis. Forexample, timing analysis could yield two or more feature scores,including at least a feature score based on a periodicity ofcommunications associated with a particular entity and a feature scorebased on variance in interval periods between communications associatedwith a particular entity. Feature scores are described in more detailbelow, however, note that the listed categories of analysis are onlyexamples, and no particular category is necessary. An embodiment mayinclude more or fewer categories resulting in more or fewer featurescores.

As shown in FIG. 69, in some embodiments, entity profile generation 6904includes a process of forensic data enrichment 6922 through globalevidence collection 6926. For example, data regarding a particularentity may be gathered from sources internal (e.g. a system blacklist)or external (e.g. a WHOIS lookup) to the computer network. Additionaldata gathered through evidenced collection 6926 and applied viaenrichment 6922 may impact feature score generation and anomalydetection based on the underlying feature scores. As with anomalyscores, a feature score can represent a quantified evaluation of therisk associated with a particular entity based on a particular analysis.Accordingly, the models used to generate feature scores may depend onadditional available (e.g. through enrichment 6922) data associated withan entity. For example, processing equivalent sets of event data 6901using the same analysis (e.g. periodicity of communications) may yielddifferent feature scores for mission critical systems than fornon-critical systems. As with the adaptive filtering 6902, Globalevidence collection 6926 and forensic enrichment 6922 are not required.

As shown in FIG. 69, in some embodiments, entity profile generation 6904includes a process for score normalization 6924. Score normalization6924 involves normalizing the plurality of feature scores for laterprocessing at the anomaly score generation stage, as described elsewhereherein.

Process 6900 continues with generating an anomaly score based on theentity profile including the plurality of feature scores included in theentity profile, for example as shown at anomaly score generation 6928.Generating an anomaly score is described in more detail elsewhereherein.

Process 6900 concludes with detecting an anomaly if the generatedanomaly score satisfies a specified criterion, for example as shown atanomaly detection 6930. Here the detected anomaly is indicative ofmalware within a computer network. Anomaly detection is also describedin more detail elsewhere herein.

B. Generating Feature Scores and the Entity Profile

As previously described, each feature score is generated based on onevarious different analyses of the event data. Feature scores arecalculated on a per-entity basis and can be understood broadly as aquantified evaluation of a level of risk associated with the entity or alikelihood that the entity is associated with malware. In someembodiments feature scores are calculated or assigned by processing theevent data through a model to generate a numerical value. In someembodiments the model includes model processing logic defining a processfor assigning a feature score based on processing the event data X102and a model state defining a set of parameters for applying the modelprocessing logic. For example, in some embodiments, the models used togenerate feature scores are the same as the anomaly models used togenerate anomaly scores. In some embodiments, the models used togenerate feature scores are machine-learning (both supervised andunsupervised) models. For example, a supervised machine learning modelmay use training examples developed by network security experts to moreeffectively generate feature scores based on received data. In someembodiments, each feature score is a numerical value in a range. Forexample, processing event data according to a feature score model mayyield a value between 0 and 10 with 0 being the least anomalous (orrisky) and 10 being the most anomalous (or risky).

As mentioned, feature scores are calculated on a per-entity basis.Therefore a plurality of feature scores is generated for a particularentity. The combined set of feature values associated with particularentity make up the entity profile. For example, the table below listsfeature scores f₁ though f_(n) for an example external domain, xyz.com.

Timing Comms. Lexical Other analysis analysis analysis analysis Entityf₁ f₂ f₃ f_(n) xyz.com 5.2 4.0 3.2 7.8

The above example is simplified for clarity. In use, an entity profilefor a particular entity might include tens or even hundreds of featurescores. In some embodiments, the feature scores associated with aparticular entity are represented as a feature vector, f={f₁ f₂ f₃ . . .f_(n)}. For example, the entity profile for domain xyz.com can berepresented as feature vector, f={5.2 4.0 3.2 . . . 7.8}.

As previously discussed, the different analyses used to generate thefeature scores can include, for example, lexical analysis (e.g.sequencing of characters in a domain name associated with an entity,analysis of the timing of communications associated with an entity (e.g.periodicity of communications and/or variance of interval times betweencommunications), analysis of the sequencing of communications associatedwith the entity (e.g. to detect exploit chains, analysis of datatransmission statistics associated with the entity (e.g. ratio of bytesin to bytes out), and analysis of referral strings associated with theentity.

In some embodiments, generating the feature scores includes analyzing asequencing of characters in an entity identifier (e.g., a domain name)associated with an entity (internal or external) and assigning a featurescore based on the analysis, wherein the feature score is indicative ofthe level of confidence that the entity identifier is machine-generated.In other words, applying a lexical analysis to a character-based entityidentifier to assign a feature score indicative of whether theidentifier is machine generated or not. This analysis and featurescoring assumes, based on industry expertise, that a machine-generatedidentifier is more likely to be associated with malicious activity (e.g.malware) given the context. For example, malware running within acomputer network may periodically transmit a beacon message (“beacon”)to an external entity (e.g. a domain) seeking command and controlinstructions. As network security has advanced so has malware. It is nolonger effective for malware to transmit beacons to a static domainbecause that domain can be quickly identified and blacklisted byexisting network security solutions. Instead, the malware may beconfigured to communicate with external entities through continuouslychanging machine-generated domain names.

One characteristic that can reveal the machine-generated nature of acharacter-based identifier is a high degree of entropy or randomness inthe sequencing of characters. One way to analyze the entropy orrandomness in the characters is through an n-gram analysis. In someembodiments, a machine learning model for n-gram analysis can be trainedusing a large body of lexical information for domain names in any numberof languages. Based on this training, a list of n-gram probabilities aredeveloped. In other words, a model based on n-gram analysis can providethe chance of observing a specific sequence of characters. FIG. 70 showstwo tables 7002 and 7004 of domain names with associated probabilitiesbased on n-gram analysis. As shown in FIG. 70, table 7002 includesdomain names with lower probabilities relative to the domain names oftable 7004. In other words, the probabilities sequence of characters inthe domain names in table 7002 occurring in natural human language arelower relative to the probabilities of the sequencing of characters inthe domain names in table 7004. This clear to a human observer just bylooking at the domain names, but the n-gram probabilities provideimportant insight to a computer-based model tasked with feature scoring.

In some embodiments, generating the plurality of feature scores includesanalyzing the timing of communications associated with the entity(internal or external) over a time period and assigning a feature scorebased on the analysis, wherein the feature score is indicative of alevel of confidence that the communications are machine-generated. Thisis similar to the ideas introduced in the discussion of beacon detectionin this Specification. Generally, the timing of communications (e.g.periodicity and/or variance of interval times) can provide insight intothe nature of the communications. For example, based on industryexpertise, communications with high periodicity are less likely to behuman generated and more likely to be machine generated, for example abeacon communication.

In some embodiments, generating the plurality of feature scores includesanalyzing a sequencing of communications associated with an entity(internal or external) over a time period and assigning a feature scorebased on the analysis, wherein the feature score is indicative of alevel of confidence that the communications are associated with anexploit chain. An Exploit is a piece of software, a chunk of data, or asequence of commands that takes advantage of a bug or vulnerability inorder to cause unintended or unanticipated behavior to occur on computersoftware, hardware, or something electronic (usually computerized). Suchbehavior frequently includes things like gaining control of a computersystem, allowing privilege escalation, or a denial-of-service attack. Anexploit chain typically involves patterns in the sequencing ofcommunications.

In some embodiments, generating the plurality of feature scores includesanalyzing the data transmission statistics associated with an entity(internal or external) over a time period and assigning a feature scorebased on the analysis, wherein the feature score is indicative of alevel of confidence that the external entity is associated with acommand and control infrastructure external to the computer network. Forexample, the ratio of bytes in to bytes out in a particularcommunication or set of communications may provide insight into thepurpose of the communication. A higher volume of data going out to anexternal entity than is coming in may indicate the exfiltration data bymalware within the network in response to commands from the externalentity.

C. Generating an Anomaly Score

The anomaly score associated with a particular entity is based on theentity profile (including the underlying feature scores) of theparticular entity. The anomaly score may be conceptualized ascombination of all of the feature scores for a particular entity.

As has been described in this Specification, in some cases anomalyscores calculated or assigned by processing event data through ananomaly model to generate a numerical value. Here, the anomaly score iscalculated or assigned by processing the plurality of feature scoresthrough an anomaly model. In some embodiments the anomaly model includesmodel processing logic defining a process for assigning a feature scorebased on the plurality of feature scores and a model state defining aset of parameters for applying the model processing logic. In someembodiments, the models used to generate the anomaly scores aremachine-learning (both supervised and unsupervised) models. For example,a supervised machine learning model may use training examples developedby network security experts to more effectively generate an anomalyscore based on the plurality of feature scores. In some embodiments,generating the anomaly score may include an ensemble learning process inwhich multiple different types of machine learning models are applied toprocessed the plurality of feature scores. In some embodiments, theanomaly score is a numerical value in a set range. For example,processing the plurality of feature scores according to an anomaly modelmay yield a value between 0 and 10 with 0 being the least anomalous (orrisky) and 10 being the most anomalous (or risky).

In some embodiments, generating the anomaly score may simply involve acalculating a weighted linear combination of feature scores. Recall thatan entity profile including a plurality of feature scores may berepresented as a feature vector, f={f₁ f₂ f₃ . . . f_(n)}. In such anembodiment, the anomaly score may simply be represented as:

${{anomaly}\mspace{14mu} {score}} = {\sum\limits_{i = 1}^{n}\; {w_{i}f_{i}}}$

Wherein w_(i) is a weighting factor applied to each feature score f_(i)and wherein the anomaly score is simply the summation of each of theplurality of feature scores with the weighting factor.

The weighting factor, w_(i) applied to any given feature score in theanomaly scoring process may depend on a number of factors, including thetype of entity to which the feature score is applied, the volume of dataused to calculate the feature score, user configuration preferences, orthe type of analysis used to generate the feature score.

As mentioned, in other embodiments, the plurality of feature scores maybe processed according to one or more machine learning models togenerate an anomaly score indicative of the probability or likelihoodthat malware is present in the computer network given the set of featurescores for a particular entity. Some machine-learning models appropriatefor this application include naïve Bayes and logistic regression.

In some embodiments ensemble learning techniques can be applied toprocess the plurality of feature scores according to a plurality ofmodels (including machine-learning models) to achieve better predictiveperformance in the anomaly scoring and reduce false positives. Anexample model suitable for ensemble learning is Random Forest. In suchan embodiment, the process may involve, processing an entity profileaccording to a plurality of machine-learning models, assigning aplurality of intermediate anomaly scores, each of the plurality ofintermediate anomaly scores based on processing of the entity profileaccording to one of the plurality of machine-learning models, processingthe plurality of intermediate anomaly scores according to anensemble-learning model, and assigning the anomaly score based onprocessing the plurality of intermediate anomaly scores.

Machine learning models are typically more effective if provided largevolumes of data to process and learn from. Accordingly, in someembodiments, the type of model applied to generate an anomaly scoredepends on the volume of data used to generate the feature scores. Forexample, some events are associated with no more than a single log lineof event data, while others are associated with hundreds of lines of loglines of event data. Accordingly, in some embodiments, a process forgenerating an anomaly score involves first determining a volume of eventdata used to generate the entity profile or any one of the plurality offeature scores. Next the entity profile is processed according to one ormore of a plurality of anomaly models depending on the determined volumeof event data. For example, in an embodiment, the entity profile isprocessed through a first anomaly model (e.g. an ensemble learningmodel) if the volume of event data is at or above a threshold volume orthe entity profile is processed through a second anomaly model (e.g.weighted linear combination) if the volume of event data is below thethreshold volume. An anomaly score is then assigned based on theprocessing. The thresholds described above can be static or dynamic. Adynamic threshold may adaptively change based on a number of factors,such as the overall volume of event data being generated on the computernetwork, the type of entity to which the anomaly score is applied, userconfiguration preferences, and the types of analysis used to generatethe feature scores. In some embodiments a plurality of threshold valuesestablish a number of regimes under which the entity profile isprocessed. For example, the detected volume of data may fall under oneof three regimes, low volume, medium volume, and high volume. Dependingon the regime, the profile entity is processed according to a differentanomaly model.

The entity profile can, in some cases, include additional data beyondthe plurality of feature scores. For example, in some embodiments,entity profile generation includes a process of forensic data enrichmentthrough global evidence collection. In such a process, data regarding aparticular entity is gathered from sources internal (e.g. a systemblacklist) or external (e.g. a WHOIS lookup) to the computer network. Insome embodiments, this data enrichment process aids the process ofgenerating an anomaly score to reduce false positives. The parametersused to apply the processing logic can depend on information about theentity and/or environment not otherwise indicated in the plurality offeature scores. For example, an mission critical computing systemassociated with a given set of feature scores is viewed differently thana non-critical computing system associated with the exact same set offeature scores. Similarly, external data can be applied validate ananomaly detection. Here the process of generating the anomaly scoreincludes comparing an entity identifier associated with an entity(internal or external) with entries in an external data source externalto the computer network (e.g. a WHOIS lookup) and assigning an anomalyscore indicating a confidence level that the entity identifier matches aparticular entry in the external data source based on the comparing.

D. Anomaly Detection and Notification

Once the anomaly score is generated, an anomaly indicating malware inthe computer network is detected if the anomaly score satisfies aspecified criterion. Consider the previously discussed example range ofvalues from 0 to 10 for anomaly scores. In this example, the specifiedcriterion may be set such that an anomaly is detected if the anomalyscore is 6 or above. The specified criterion need not be static,however. In some embodiments, the criterion is dynamic and changes basedon situational factors. Situational factors may include volume of eventdata, presence or absence of pre-conditional events, userconfigurations, and volume of event data.

If an anomaly indicating malware in the computer network is detected,and indication of that anomaly can be outputted for display to a uservia a user interface of a computing device. FIG. 71 shows an exampleincident response output 7100 based on entity profiles configured fordisplay to a user. The incident response output 7100 is represented insimplified form for clarity as a table including a plurality of entityidentifiers 7102 with associated feature scores 7104 a-7104 d and arecommended response 7106 based on the plurality of feature scores. Theparticular arrangement of information should not be construed aslimiting. In this example, the entity identifier is a domain name,however, the entity identifier associated with the entity can be anyidentifier, such as a domain name, a uniform resource locater (URL),uniform resource identifier (URI), an Internet Protocol (IP) address, aunique identifier (UID), a device identification, or a useridentification. As shown in FIG. 71, the plurality of feature scores7104 a-7104 d are displayed as classifications, i.e. no risk, moderaterisk, and high risk, instead of numerical values. These classificationscan be based on the underlying numerical feature scores. In someembodiments, the numerical feature score values (e.g. 0 to 10) aredisplayed to the user via the incident response output. The analystrecommendation 7106 provides information guiding the user to take actionbased on the raised anomaly associated with entity 7102. For example,the domain “www.evil.com” has a communication feature score indicativeof a high risk to network security due to ongoing unblockedcommunications. The recommendation 7106, accordingly lists this as acritical priority due to the ongoing and unblocked nature of thecommunications. In some embodiments, the analyst recommendation 7106 isprovided by a human security analyst based on an assessment of thefeature scores associated with the entity. In some embodiments, theanalyst recommendation is automatically generated by the system based onthe feature scores and or the anomaly score, for example through the useof established network security rules.

Detected anomalies indicative of malware on the computer network can bestored in an anomaly graph data structure that includes a plurality ofnodes representing entities associated with the computer network, and aplurality of edges representing an anomaly linking two of the pluralityof nodes. Further, the anomaly data can be incorporated into a systemwide network security graph. A network security graph includes aplurality of nodes representing entities associated with the computernetwork and a plurality of edges, each of the plurality of edges linkingtwo of the plurality of nodes and representing an association betweenthe entities represented by the nodes. In such a graph the detectedanomalies can be incorporated as a node linked to one or more entitiesby an edge.

XV. Beaconing Detection

Malware is malicious software (e.g., virus, Trojan horse, or the like)installed on a computer or other device without the knowledge orpermission of the owner of the device for an improper purpose, such asto steal private data or as a prank.

Various techniques have used to detect and defend malware. Many of thesetechniques monitor the Internet Protocol (IP) pairs in outgoing trafficfrom a computer to determine whether the outgoing traffic is indicativeof malware. Each IP pair includes an IP address of the computer fromwhich the traffic originates and IP address of the traffic'sdestination. The techniques can detect malwares by examining whether anyof the IP addresses are blacklisted, occurring frequently, etc. Thesetechniques have drawbacks, however.

For example, monitoring the IP pairs of outgoing traffic can be resourceintensive, especially if the outgoing traffic of the computer isvoluminous. Further, the problem is only compounded as the number ofcomputers in a network, e.g., computers in an organization's network,increases. Monitoring the computers in real-time can also be challengingconsidering the number of IP pairs can be in significantly largenumbers.

Malware programs tend to communicate with their command and control(C&C) entity (e.g., a website) to receive new instructions and they tendto contact the C&C entity periodically. Typically, machine-generatedtraffic, such as traffic generated by malware, tends to have a distinctpattern from user-generated traffic, such as traffic generated from auser browsing a webpage or accessing other resources on the Internet.Most techniques fail to recognize the distinction between themachine-generated traffic and the user-generated traffic that can helpin detecting malware efficiently.

Described herein is a technique for detecting machine-generated trafficin outgoing traffic of a computer device (“device”) and determiningwhether the machine-generated traffic represents an anomaly. Theoutgoing traffic can include user-generated traffic, which can includeconnection requests generated from a user associated with the device,such as when the user accesses a website, checks email and downloadsapplications. The outgoing traffic can also include legitimate (notmalware related) machine-generated traffic, which is generated by thedevice or an application executing on the device without interventionfrom the user, such as updates to applications, messages forsynchronizing time of the device, device-to-device communication withinanother device in a distributed computing system of which the device isa part, a heartbeat signal generated by an application on the device,which can be a signal that is generated at regular intervals to indicatethat the application is working as expected. The machine-generatedtraffic can also include traffic generated by some applications, such asa malware, that can be malicious in nature. Some of themachine-generated traffic can be in the form of a beacon, which is asignal that is transmitted periodically or in a manner that satisfies aparticular criterion for periodicity/regularity.

The malware beacon detection technique introduced here distinguishesbetween user-generated traffic and machine-generated traffic and, if thetraffic is machine-generated, determine whether the machine-generatedtraffic is benign or suspicious (e.g., anomalous). The technique can usevarious methods to filter out benign machine-generated traffic. Forexample, the technique can use different heuristics and whitelists todetermine whether the traffic is benign. The technique can furtheranalyze the anomalies to determine whether they are a threat and raisean alarm if they are one.

The technique determine if the outgoing traffic is user-generatedtraffic based on a number of parameters, such as number of connectionrequests originating from the device in a predefined period, periodicityof the connections, number of web objects requested by the device,number of destinations contacted by the device, number of times adestination is contacted and number of ports of the destinationscontacted.

The malware beacon detection technique introduced here can operate inreal-time, e.g., as and when the traffic is generated from the computerdevice. The technique can perform the above described method usingreal-time infrastructure, e.g., real-time analyzer 210 of FIG. 2 and/oranalysis module 330 of FIG. 3 described above. Additionally oralternatively, the technique can operate in a batch processing mode byusing the batch processing infrastructure, e.g., batch analyzer 240and/or batch analysis module 382.

Further, the above described method can be performed by a model, such asa machine learning model. The model can output the result of thedetection as a yes or no (or the equivalent), or as a score based onwhich the machine-generated traffic can be determined as an anomalous ornot. The model can be implemented in real-time infrastructure and/orbatch processing infrastructure.

Turning now to the figures, FIG. 72 shows an example graph 7200 ofoutgoing traffic of a device. The example graph 7200 depicts trafficgenerated from a device over a period, e.g., seventeen seconds. Theexample graph 7200 depicts the traffic as a number of connectionrequests originating from the device. The outgoing traffic can includetwo categories of traffic: user-generated traffic and machine-generatedtraffic. For example, the first outgoing traffic 7205 and the secondoutgoing traffic 7215 which represent traffic generated from useractivity, e.g., from a web browsing activity, are categorized asuser-generated traffic. On the other hand, the third outgoing traffic7210 and the fourth outgoing traffic 7220, which represent trafficgenerated due to various machine-related activities that are performedwithout the intervention of a user of the device, are categorized asmachine-generated traffic. Examples of such machine-generated trafficcan include a beacon to an external server, which determines whetherthere is any update available for an application installed at thedevice; a message from the device to a server for synchronizing time ofthe device; or malware that is communicating with a C&C entity.

In the example graph 7200, when the user performs an activity, e.g.,browses a webpage, the user generates a large volume of connectionrequests. When the user does not interact with the computer, there canbe a silent period, e.g., a period with minimal activity or no activity.The technique can detect these silent periods and analyze the trafficgenerated during that time. For example, if malware contacts its C&Centity during the silent periods, the technique can detect suchmachine-generated traffic as anomalous.

In the first outgoing traffic 7205, which can represent trafficcorresponding to a user accessing a webpage, a significantly high numberof connection requests, e.g., reaching almost fifty, have been generatedwithin a span of four seconds. A website can host content stored atdifferent locations, e.g., at different servers. For example, a webpageof the website can host a number of images, advertisements, etc. thatare stored at different servers. When a user accesses the webpage, thedevice can generate a number of connection requests that are sent todifferent servers for obtaining different portions of the webpage, e.g.,images, cascading stylesheets (CSS). As the content of webpage isretrieved from their respective locations, the traffic decreases and thenumber of connections decrease to zero. That is, the number ofconnections increases and/or decreases rapidly.

In the second outgoing traffic 7210, which represents machine-generatedtraffic, the number of requests are comparatively low, e.g., do notexceed ten at any instance. That is, for a predefined period, the numberof requests is typically lower than the number of requests compared touser-generated traffic. Also, the connection requests in the secondoutgoing traffic 7210 is more periodic than the connection requests inthe first outgoing traffic 7205. For example, the connection requestsappear every two seconds in the second outgoing traffic 7210.

From the example graph 7200, it can be observed that a user-generatedactivity can include a significantly higher number of connectionrequests than machine-generated traffic for a predefined period. It canalso be observed that the connection requests in the user-generatedtraffic increase and/or decrease at a rate higher than a specifiedthreshold, i.e., connection requests are generated aperiodically orirregularly. In the machine-generated traffic, the connection requestsare generated in a more periodic manner than the user-generated traffic.

FIG. 73 lists an example of a set of parameters that can be consideredfor distinguishing between machine-generated traffic and user-generatedtraffic, consistent with various embodiments. The technique candistinguish between machine-generated traffic and user-generated trafficas a function of one or more of the set of parameters 7300. The set ofparameters 7300 can include a number of connection requests generated ata device in a predefined period, periodicity of the connection requests,e.g., a period or frequency between the connections, number of differentdestinations contacted, e.g., a diversity of the Internet Protocol (IP)addresses, a number of web objects downloaded to the device, a number ofports at which the destinations are contacted and a Uniform ResourceIdentifier (URI) of the destinations. Some of the set of parameters 7300can be part of the outgoing traffic data and therefore, can be readilyavailable for use by the technique. However, some of the set ofparameters 7300 are determined by the technique, e.g., based on theparameters available in the outgoing traffic data. Additional detailswith respect to distinguishing between user-generated traffic andmachine-generated traffic are described at least with reference to FIGS.74 and 75.

FIG. 74 is a block diagram of an environment 7400 in which a system 7425for detecting anomalies in machine-generated traffic can be implemented,consistent with various embodiments. In some embodiments, the system7425 is implemented as part of the threat detection platform 300 of FIG.3. The system 7425 can be implemented as part of the real-timeinfrastructure 330 or batch processing infrastructure 382. In someembodiments, the system 7425 is implemented as part of the real-timeinfrastructure 330. Further, in some embodiments, at least a portion ofthe system 7425 is implemented as part of a model in the real-timeinfrastructure 330 or batch processing infrastructure 382. Theenvironment 7400 includes a computer device 7405 whose outgoing trafficis monitored for detection of anomalies and/or threats. The device 7405can be part of a distributed computing system having a number ofdevices. For example, the device 7405 can be one of many devices in acomputer network 7465 of an organization. The network 7465 can be alocal area network (LAN), a wide area network (WAN), etc.

The outgoing traffic from device 7405 can include outgoing traffic thatis internal to the network 7465 (“internal traffic”), e.g.,communications with devices in the network 7465, and outgoing trafficthat is external to the network 7465 (“external traffic”), e.g.,communications with servers 7415 in the network 7410 such as Internet.The network 7410 is external to the network 7465. The system 7425monitors the outgoing traffic of the device 7405, e.g., using outgoingtraffic log 7450, and detects any existence of anomalies and/or threats.

In some embodiments, the system 7425 is configured to monitor a portionof the outgoing traffic from the device 7405, e.g., external traffic.The outgoing traffic log 7450 can be obtained from a proxy, gateway or afirewall of the network 7465 in which case the outgoing traffic log 7450may not include internal traffic information. However, the monitoringmay not be restricted to external traffic and the system 7425 can beused to monitor both external and internal traffic.

The outgoing traffic can be any class of traffic, e.g., web traffic orIP traffic. The web traffic can include Hyper-Text Transfer Protocol(HTTP) message, which can be associated with parameters such as adestination IP address, a URI of the destination, a port number, a typeof web request—GET or POST, etc. The IP traffic can be associated withparameters such as a destination IP address and a port number.

The outgoing traffic log 7450 can be processed by one or more componentsprior to being input to the system 7425. For example, after a datareceiver 310 obtains information regarding the outgoing traffic of thedevice 7405 from one of the sources 302, the semantic processor 316 canprocess the outgoing traffic information to remove, add or modify atleast some of the information and generate the outgoing traffic log 7450in a condition that is suitable for further processing by the system7425 efficiently. For example, the semantic processor 316 can removeinternal traffic, e.g., data transfers that occur between two internaldevices as part of file backup, which is less likely or unlikely to bean anomaly, from the outgoing traffic information.

The traffic classification module 7430 analyzes the outgoing traffic log7450 and detects if the outgoing traffic is machine-generated traffic7445. If the outgoing traffic is machine-generated traffic 7445, thetraffic classification module 7430 passes the outgoing traffic to theanomaly detection module 7435, which determines if the machine-generatedtraffic 7445 is benign traffic or an anomaly 7455. If themachine-generated traffic 7445 is an anomaly 7455, the anomaly detectionmodule 7435 passes the anomaly 7455 to a threat analysis module 7460.The threat analysis module 7460 determines if the anomaly 7455 is athreat and generates a notification, e.g., an alarm, if it is one.

Referring back to the detection of machine-generated traffic 7445, thetraffic classification module 7430 analyzes the connection requests inthe outgoing traffic log 7450 to form a group of connection requests anddetermines if the group is user-generated traffic or machine-generatedtraffic. In some embodiments, the group of connection requests is eithermachine-generated traffic or user-generated traffic and cannot be both.However, two different groups can be of different classes of traffic.The traffic classification module 7430 can form the group based onvarious criteria. The traffic classification module 7430 can form agroup by grouping the connection requests in the outgoing traffic log7450 that are closer to each other in time. For example, the trafficclassification module 7430 groups the connection requests that aregenerated within “20” seconds from the time a first connection requestof the outgoing traffic log 7450 is generated into the same group. Insome embodiments, the outgoing traffic log 7450 is received in real-timeand the traffic classification module 7430 can start forming the groupas and when the first connection request is generated at the device7405.

The traffic classification module 7450 determines whether the group ofconnection requests is user-generated traffic or machine-generatedtraffic. The user-generated traffic, as described above, can be a resultof an activity performed by a user 7420 associated with the device 7405,e.g., accessing a webpage in the Internet using the device 7405. Themachine-generated traffic, as described above, can be generated by thedevice 7405 or an application executing on the device 7405 withoutintervention from the user 7420, such as updates to applications,messages for synchronizing time of the device, a heartbeat signal froman application or beacons from a malware.

The traffic classification module 7450 determines whether the group ofconnection requests is user-generated traffic or machine-generatedtraffic based on a set of parameters, e.g., set of parameters 7300 ofFIG. 73. For example, the traffic classification module 7450 determineswhether the group is user-generated traffic or machine-generated trafficas a function of one or more of a number of different destination IPaddresses in the group, that is, a number of destinations contacted bythe device 7405; a number of web objects downloaded by the group; anumber of destination ports in the group; or a periodicity of theconnection requests in the group.

The traffic classification module 7430 determines whether a periodicityof the connections in the group satisfy a periodicity criterion. In someembodiments, the periodicity of the connection requests is determined asa function of the timing between the connection requests in the group.For example, the periodicity can be an average of the periods betweeneach of the connection requests in the group. The traffic classificationmodule 7430 determines that the group is likely to be machine-generatedtraffic if the periodicity of the connection requests satisfies aperiodicity criterion, e.g., exceeds a specified threshold; otherwisedetermines the group as likely to be user-generated traffic.

As described above at least with reference to FIG. 72, a user activitysuch as accessing a webpage can generate a high number of requests todifferent destinations within a predefined period, download asignificant number of web objects, e.g., images, cascading stylesheets(CSS), and/or contact different destinations at different ports.

In some embodiments, the traffic classification module 7450 determinesthat the group is likely to be user-generated traffic if a diversity ofthe destination IP addresses in the group (i.e., the number ofdestinations contacted) exceeds a specified threshold. In someembodiments, the traffic classification module 7450 determines that thegroup is likely to be user-generated traffic if the number of webobjects downloaded exceeds a specified threshold. In some embodiments,the traffic classification module 7450 determines that the group islikely to be user-generated traffic if the number of ports in the groupexceeds a specified threshold. The traffic classification module 7430can be configured to consider one or more of the above parameters fordetermining whether the outgoing traffic is user-generated traffic. Ifthe traffic classification module 7430 determines that the outgoingtraffic is likely to be user-generated traffic, the group may not beanalyzed further to detect an anomaly.

The system 7425 can check if the group includes connection requests toany whitelisted destinations. A whitelist can be a list of destinationsthat are considered to be safe to be accessed by the devices in thenetwork 7465. A user such as an administrator of the network 7465 cangenerate the whitelist. The whitelist can also be created and/ormodified automatically, e.g., by one or more models executing in thereal-time infrastructure 330 or the batch processing infrastructure 382.If the group includes connections requests to the whitelisteddestinations the group may not be analyzed any further for detecting ananomaly.

In some embodiments, the system 7425 determines if the group includeswhitelisted destinations prior to determining whether the group isuser-generated traffic so that if the group includes whitelisteddestinations the system 7425 does not have to analyze the group anyfurther, thereby saving computing resources. The analysis of whether thegroup includes whitelisted destinations can be performed by the trafficanalysis module 7425 or other modules, e.g., semantic processor 316.

The anomaly detection module 7435 further analyzes the machine-generatedtraffic 7445 to determine whether it is likely to be an anomaly. Asdescribed above, some of the machine-generated traffic 7445 can bebenign and some anomalous, e.g., malicious. The anomaly detection module7435 analyzes the group further to determine if the machine-generatedtraffic 7445 includes benign traffic or anomalous traffic. The anomalydetection module 7435 extracts beacon data 7470 from themachine-generated traffic 7445. The beacon data 7470 can includeparameters such as destination IP address(es) of the connection requestsin the group, destination port(s), and if the connection request is aHTTP request, the beacon data 7470 can also include a type of theconnection request, e.g., a GET or POST, and URI of the destination. Theanomaly detection module 7435 compares the beacon data 7470 with any ofthe known group types (also referred to as “beacon types”) that areidentified as likely to be anomalous to determine whether themachine-generated traffic is anomalous. Additional details ofdetermining whether the machine-generated traffic is anomalous aredescribed at least with reference to FIG. 75.

The traffic classification module 7430 can determine that the group islikely to be machine-generated traffic 7445 if the group is notwhitelisted, satisfies periodicity criterion and not user-generatedtraffic. Further, the machine-generated traffic that is not identifiedas benign traffic is recognized as anomalous.

FIG. 75 shows an example 7500 of a memory cache storing beacon typesthat are identified as likely to be anomalous, consistent with variousembodiments. In some embodiments, a beacon type includes a group or anumber of similar groups that are identified as likely to be anomalous.The anomaly detection module 7435 can store the beacon type in a memorycache 7440 associated with the system 7425. A beacon type 7505 can storebeacon parameters 7510 such as destination IP address(es) of connectionrequests in a group, destination port(s), the type of connectionrequest, e.g., HTTP GET or POST, a URI of the destination. The anomalydetection module 7440 stores the beacon parameters 7510 of a group as avector 7520 and a timestamp, which indicates the time at which the groupoccurred in the outgoing traffic, in an array 7515 of the beacon type7505. If multiple groups are stored in the beacon type 7505, then thebeacon type 7505 can include multiple vectors, e.g., one for eachcorresponding group, and a timestamp entry for each of the groups in thearray 7515.

In determining whether the group to which the beacon data 7470corresponds is anomalous, the anomaly detection module 7435 compares thebeacon data 7470 with the beacon types in the memory cache 7440 todetermine if the beacon data 7445 matches with any of the beacon typesin the memory cache 7440. If the beacon data 7445 matches with any ofthe beacon types, e.g., beacon type C, the anomaly detection module 7435adds the beacon data 7445 to the beacon type C. The anomaly detectionmodule 7435 determines if the group represents an anomaly as a functionof a frequency of the occurrence of the groups in the beacon type C.

As described above, some of the machine-generated traffic 7445 can bebenign and some anomalous, e.g., malicious. The anomaly detection module7435 analyzes the group further to determine if the machine-generatedtraffic 7445 includes benign traffic or anomalous traffic. Typically,malware sends a beacon to its C&C regularly and in high frequency. Thatis, a gap or timing between the beacons is typically lesser than aspecified threshold. Long gaps between the connection requests, e.g.,timing exceeding the specified threshold, can usually be attributed tobenign traffic, such as an application on a device checking with aserver in the Internet for software updates, which can also send beaconsregularly. However, the beacons for such software updates can be lessfrequent than the beacons of malware.

In the example 7500, the first occurrence of a group of beacon type C,is at time t, the second occurrence at time (t+x), the third occurrenceat time (t+x+y), the fourth occurrence at time (t+x+y+z) and so on. Theanomaly detection module 7435 determines the number of occurrences ofthe groups and timing between the occurrences of the group. If thefrequency of the groups satisfy a periodicity criterion, e.g., if anaverage timing (average (x, y, z)) between the occurrences of the groupssatisfies a specified timing threshold, and the groups occur at least afirst threshold number of times, the anomaly detection module 7435determines the group to which the beacon data 7470 corresponds and theother groups of the beacon type with which the beacon data 7470 matchesas anomalous. When a group is recurring but not strictly periodic, e.g.,the average timing (average (x, y, z)) does not satisfy the specifiedtiming threshold, the anomaly detection module 7435 determines if thegroups occurred at least a second threshold number of times in which thesecond threshold number is greater than the first threshold number. Ifthe groups occurred at least a second threshold number of times, theanomaly detection module 7435 determines the groups as anomalous. Ifneither of the periodicity thresholds is satisfied, the group isdetermined as likely to be benign traffic.

After the anomaly detection module 7435 determines the groups to beanomalous, the anomaly detection module 7435 indicates those groups asan anomaly 7455 to the threat analysis module 7460, which can furtheranalyze the anomaly 7455 to determine if it is a threat and raise analarm, e.g., generate a notification, if it is one. The anomaly 7455 caninclude various information, e.g., information from the beacon data 7470and/or information from the beacon type with which the beacon data 7470matched. The anomaly detection module 7435 can also include additionaldata in the anomaly 7455 which can be used by the threat analysis module7460 in determining if the anomaly 7455 is a threat.

Referring back to determining a matching beacon type in the memory cache7440, the set of parameters that may be considered to determine a matchcan include at least one of destination IP address(es) of the connectionrequests, destination port(s), and if the connection request is a HTTPrequest, a type of the connection request, e.g., a GET or POST, and aURI of the destination. If a particular group matches with a beacontype, then the particular group and the groups stored in the beacon typecan be considered to be similar groups. Various criteria can be definedto determine whether a group matches with a beacon type. For example,the beacon data 7470 is considered to match with a beacon type in thememory cache if all of the set of parameters of the beacon data matcheswith that of the beacon type. In another example, the beacon data 7470is considered to match with the beacon type if at least one of the setof parameters of the beacon data matches with that of the beacon type.In another example, the beacon data 7470 is considered to match with thebeacon type if at least a portion of one of the set of parameters, e.g.,a portion of the destination IP address, of the beacon data matches withthat of the beacon type.

FIG. 76 is a flow diagram of a process 7600 for determining whetheroutgoing traffic from a device is an anomalous traffic, consistent withvarious embodiments. In some embodiments, the process 7600 isimplemented in the environment 7400 and using the system 7425. Theprocess 7600 can be performed as part of a model in the real-timeinfrastructure 330 or batch infrastructure 382. At block 7605, thetraffic classification module 7430 receives information regardingoutgoing traffic of a device. For example, the traffic classificationmodule 7430 receives outgoing traffic log 7450, which containsinformation regarding outgoing connection requests from device 7405. Aconnection request is a request for connecting to a particularcomputer/server in network 7465 and/or network 7410. The outgoingtraffic can be web traffic, e.g., HTTP traffic, or IP traffic. Further,in some embodiments, the outgoing traffic does not include internaltraffic, e.g., traffic between devices within the network 7465.

At block 7610, the traffic classification module 7430 analyzes theoutgoing traffic to form a group of connection requests. The connectionrequests in the outgoing traffic can be grouped based on variouscriteria. In some embodiments, the connection requests are grouped basedon a time at which the connection requests were generated at the device.For example, connection requests that are closer in time to each otherwithin a predefined period are grouped together. Additional details withrespect to forming the group are described at least with reference toFIG. 77.

At determination block 7615, the traffic classification module 7430determines if the group contains connection requests to one or moredestinations that are identified as acceptable destinations. The system7425 can have access to a list of acceptable destinations, e.g., awhitelist. The destination information in the whitelist can include oneor more of IP address of a destination, a URI of the destination or portof the destination.

If the connection requests are to whitelisted destinations, then thegroup is not monitored any further and the process 7600 returns. On theother hand, if the connection requests are to destinations that are notwhitelisted, at determination block 7620, the traffic classificationmodule 7430 analyzes the group to determine whether the group isuser-generated traffic or machine-generated traffic. Examples ofuser-generated traffic can include traffic generated as a result of useractivity, such as the user accessing a website, checking email anddownloading applications. Examples of machine-generated traffic caninclude traffic generated by the device or an application executing onthe device without intervention from the user, such as updates toapplications, messages for synchronizing time of the device,device-to-device communication between devices in a distributedcomputing system, benign beacons, e.g., heartbeat signals generated byan application on the device, or beacons generated by malware.

In some embodiments, the traffic classification module makes thedetermination of whether the group is user-generated traffic ormachine-generated traffic based on a set of parameters described atleast with reference to FIG. 73. If the traffic classification module7430 determines the group as user-generated traffic, then the group isnot monitored any further and the process 7600 returns.

On the other hand, if the traffic classification module 7430 determinesthe group as machine-generated traffic, at block 7625, the anomalydetection module 7435 determines whether the group represents anomaloustraffic. In some embodiments, the anomaly detection module 7435 makesthe determination as a function of a frequency of occurrence of thegroup in the outgoing traffic, or as a frequency of occurrence of groupsdetermined to be similar to the group. Additional details with respectto determining whether the machine-generated is anomalous are describedat least with reference to FIG. 78.

FIG. 77 is a flow diagram of a process 7700 for forming a group ofconnection requests from outgoing traffic of a device, consistent withvarious embodiments. The process 7700 may be implemented as part ofblock 7610 of process 7600. At block 7705, the traffic classificationmodule 7430 monitors the outgoing traffic log 7450 to identify a firstconnection request from the device 7405. Upon identification of a firstconnection request, at block 7710, the traffic classification moduleforms a group and adds the first connection request to the group. Thetraffic classification module 7430 also records the time at which thefirst connection request was generated.

The traffic classification module 7430 continues to monitor the outgoingtraffic log 7450 for subsequent connection requests from the device7405. At block 7715, the traffic classification module 7430 detects asubsequent connection request in the outgoing traffic log 7450. Atdetermination block 7720, the traffic classification module 7430determines if the subsequent connection request satisfies a groupingcriterion. The grouping criterion can be based on a period between thetime at which the first connection is generated and that of thesubsequent connection request. The traffic classification module candetermine whether the subsequent request is received within a predefinedperiod from the time the first connection request was received, e.g.,within twenty seconds from the first connection request.

If the subsequent connection request satisfies the grouping criterion,at block 7725, the traffic classification module 7430 adds thesubsequent connection request to the group, and the process continuesmonitoring for subsequent requests. On the other hand, if the subsequentconnection request does not satisfy the grouping criterion, the process7700 returns.

FIG. 78 is a flow diagram of a process 7800 for determining whether aparticular group of connection requests in the outgoing traffic of adevice is user-generated traffic or machine generated traffic,consistent with various embodiments. In some embodiments, the process7800 may be implemented as part of block 7620 of process 7600. At block7805, the traffic classification module 7430 analyzes the connectionrequests to obtain a set of parameters for determining whether theparticular group is user-generated traffic or machine-generated traffic.As described in FIG. 73, the set of parameters can include one or moreof IP addresses of destinations of the connection requests in theparticular group, (b) a number of web objects downloaded by theconnection requests in the particular group, (c) a number of ports ofthe destinations, or (d) periodicity of the connection requests.

At determination block 7810, the traffic classification module 7430determines if the set of parameters satisfies the user-generatedactivity criteria. For example, the traffic classification module 7430determines that the group is user-generated traffic if the number ofdifferent IP addresses of the destinations, that is, a diversity of theIP addresses, exceeds a first specified threshold. In another example,the traffic classification module 7430 determines that the group isuser-generated traffic if the number of web objects downloaded by theparticular group exceeds a second specified threshold. In anotherexample, the traffic classification module 7430 determines that thegroup is user-generated traffic if the number of ports exceeds a thirdspecified threshold.

In some embodiments, the periodicity of the connection requests isdetermined as a function of the timing between the connection requestsin the particular group. For example, the periodicity can be an averageof the periods between each of the connection requests in the group. Insome embodiments, the traffic classification module 7430 determines thatthe particular group is likely to be machine-generated traffic if theperiodicity of the connection requests satisfies a periodicitycriterion, e.g., exceeds a specified threshold; otherwise determines theparticular group as likely to be user-generated traffic.

The user-generated activity criteria can be configured in various ways.In some embodiments, all of the set of parameters have to satisfy thecriteria for determining that the group is user-generated activity. Insome embodiments, one or more of the set of parameters have to satisfythe criteria for determining that the group is user-generated activity.

If the set of parameters satisfies the user-generated activity criteria,at block 7820, the traffic classification module 7430 determines thatthe particular group is user-generated activity; the trafficclassification module 7430 stops analyzing the particular group furtherand the process 7800 returns. On the other hand, if the set ofparameters does not satisfy the user-generated activity criteria, atblock 7815, the traffic classification module determines that theparticular group is machine-generated traffic.

FIG. 79 is a flow diagram of a process 7900 for determining whethermachine-generated traffic is anomalous, consistent with variousembodiments. The process 7900 may be implemented as part of block 7625of process 7600. The system 7425 analyzes a particular group ofconnection requests that is identified as machine-generated traffic,e.g., in process 7800, to determine whether the machine-generatedtraffic is benign or anomalous. At determination block 7905, the anomalydetection module 7435 compares the particular group with one or morebeacon types, e.g., beacon types in memory cache 7440, that areidentified as likely to be anomalous to determine if the particulargroup is similar to any of the beacon types. In some embodiments, thecomparison is performed as described at least with reference to FIG. 75.

If the particular group is similar to any of the beacon types, e.g.,beacon type “C”, at block 7910, the anomaly detection module 7435 addsthe particular group to the beacon type “C.” If the particular group isnot similar to any of the beacon types, at block 7925, the anomalydetection module determines that the particular group is likely to bebenign traffic and the process 7900 returns.

At determination block 7915, the anomaly detection module 7435determines if the groups in the beacon type satisfy a periodicitycriterion. In some embodiments, a periodicity of the groups isdetermined as a function of the frequency at which the groups in thebeacon type occurred in the outgoing traffic. For example, theperiodicity can be an average of the periods between each of the groupsin the beacon type.

In some embodiments, to determine the group as anomalous, the group mayhave to occur at least “X” times and periodically. When a group isrecurring but not strictly periodic, the group may have to occur atleast “Y” times, where “Y”>“X” because a periodic behavior is a strongerindication of machine activity. Therefore, if a group is simplyrecurring, but not periodically enough, the group may have to occur moretimes before the anomaly detection module 7435 can determine it asanomalous. The groups can be considered to be periodic, if an averagetiming between the occurrences of the groups in the beacon typesatisfies a specified timing threshold.

Accordingly, the periodicity criterion can state that if the groups inthe beacon type are periodic, then then groups have to occur a firstthreshold number of times else the groups have to occur a secondthreshold number of times for the groups in the beacon type to beconsidered as anomalous. Further, the periodicity criterion can requirethat the second threshold number to be greater than the first thresholdnumber.

Referring back to determination block 7915, if the groups in the beacontype satisfy the periodicity criterion, at block 7920, the anomalydetection module 7435 determines that the groups in the beacon type areanomalous. If the groups in the beacon type do not satisfy theperiodicity criterion, at block 7925, the anomaly detection module 7435determines that the groups in the beacon type are likely to be benigntraffic, and the process 7900 returns.

XVI. Rarity Analysis

Described herein is a technique for determining rarity of features ofdata traffic (“traffic”) in a computer network. Determination of raritycan be used to detect anomalies represented in event data. The techniquecomputes a rarity score for each of various values of a feature of eventdata, where each rarity score indicates how rare the occurrence of thecorresponding particular value is relative to occurrences of othervalues of that feature, and then determines if network activity or anevent in which that particular value of the feature occurs is anomalous,based on the rarity score.

Examples of features regarding which a rarity score can be computed inthis manner include, for example: a field, attribute, and/or property ofthe data traffic on and/or an entity associated with the computernetwork, e.g., a username of a user, a source zone of the network fromwhich the traffic is originating, a destination zone of the network towhich the traffic is destined, the port identifier of a port throughwhich data is transmitted, a name of an application that transmitsand/or receives the data, and an identification (ID) of a device, suchas an Internet Protocol (IP) address, that transmits and/or receives thedata. The feature can be of high cardinality, i.e., can have one of afinite number of values. For example, a feature such as a port can havemultiple values, e.g., 20, 22, 23, 25, 80, which are associated withspecific network protocols. In the data traffic, a particular value of afeature may occur more commonly, e.g., more number of times, thananother value of the feature. For example, in a computer network wheremost traffic into and/or out of the network is web traffic, port 80,which corresponds to Hyper Text Transfer Protocol (HTTP), may occur morecommonly than other ports, e.g., port 23.

In some embodiments, the rarity determination technique determines therarity of a particular value of a feature (such as one of the featuresmentioned above) as a function of the probability of occurrence of thatparticular value relative to the probability of occurrence of othervalues of the feature. In some embodiments, the technique considers thevalues that are as likely or less likely to occur than that particularvalue to determine the probability (also referred to as “relativeprobability”) of occurrence of the particular value. After determiningthe probability of the particular value relative to the other values,the technique may compute a confidence interval of that probability toobtain the rarity score. In some embodiments, the rarity score is avalue between 0 and 1. The technique can use known methods, such as thedelta method, for computing the confidence interval.

If the rarity score for the particular value satisfies a raritycriterion, the technique can identify an activity or event in which theparticular value occurred as anomalous. In some embodiments, the rarityscore satisfies the rarity criterion if the rarity score is below aspecified score threshold and the number of times that the particularvalue has been identified as corresponding to an anomaly is less than aspecified count threshold.

The technique can also determine the rarity score for more than onefeature, e.g., a feature pair, which indicates how rare it is to observea first feature at a particular value when the second feature isobserved at a first value. That is, the rarity score of a feature pair(X, Y) indicates how rare it is to observe “X=a” when “Y=p” and/or howrare it is to observe “Y=p” when “X=a.” Consider an example in whichdata can be transmitted from one or more source devices to one or moredestination devices. The data can be transmitted from a portion of thenetwork identified as “Zone A” to a portion of the network identified as“Zone B,” from “Zone C” to “Zone B,” “Zone D to “Zone B,” and/or “Zone Ato “Zone D.” The technique can determine how rare it is to observe asource zone being “Zone A” when the destination zone is “Zone B.” Basedon the rarity score of the feature pair, the technique can determinewhether an event of which the feature pair is a part corresponds to ananomaly.

Turning now to the figures, FIG. 80 is a block diagram of an environment8000 in which a system 8025 for detecting anomalies based on rarityscores of features can be implemented. In some embodiments, the system8025 is implemented as part of the security platform 300 of FIG. 3. Thesystem 8025 can be implemented as part of the real-time infrastructure330 or batch processing infrastructure 382. Further, in someembodiments, at least a portion of the system 8025 is implemented aspart of a machine learning model in the real-time infrastructure 330 orbatch processing infrastructure 382. The environment 8000 includes acomputer device (“device”) 8005 whose data traffic is monitored fordetection of anomalies and/or threats. The device 8005 can be part of adistributed computing system having a number of devices. For example,the device 8005 can be one of many devices in a computer network 8065 ofan organization. The network 8065 can be a local area network (LAN), awide area network (WAN), etc.

The traffic can include data transmitted by or received at the computerdevice 8005. The traffic from device 8005 can include traffic that isinternal to the network 8065 (“internal traffic”), e.g., communicationswith devices in the network 8065, and traffic that is external to thenetwork 8065 (“external traffic”), e.g., communications with servers8015 in the network 8010 such as Internet. The network 8010 is externalto the network 8065. In some embodiments, at least a portion of thetraffic is generated due to activity of a user 8020 associated with thecomputer device 8005. The system 8025 monitors the traffic of the device8005, e.g., using traffic log 8050, and detects any existence ofanomalies and/or threats. The traffic log 8050 includes event dataincluding multiple events representative of traffic into and/or out ofthe network 8065. The traffic log 8050 can be generated based on dataobtained from a proxy, a gateway or a firewall associated with thenetwork 8065.

The traffic can be any class of data traffic, e.g., web traffic or IPtraffic. The web traffic can include an HTTP message, which can haveparameters such as a destination IP address, a URI of the destination, aport number, a type of web request—GET or POST, etc. The IP traffic canhave parameters such as a destination IP address and a port number.

A machine learning model that implements the rarity analysis techniquedescribed here can subscribe to one or more event views (describedabove), via the model registry. Through such event view(s), the modelcan access the appropriate features of the event data that includes orrepresents traffic log 8050, to enable the model to perform the rarityanalysis. The semantic processor 316 (FIG. 3) can process the event datato remove, add or modify at least some of the information and generatethe traffic log 8050 in a condition that is suitable for furtherprocessing by the system 8025 efficiently. For example, the semanticprocessor 316 can remove traffic that is between two devices which areidentified as acceptable end points for message transmission, as suchtraffic is less likely or unlikely to be an anomaly.

Any event in the traffic log 8050 can include one or more features. Todetermine whether or not an event is anomalous, the system 8025 mayanalyze some or all of the features in the event. In some embodiments,the feature tracking module 8030 analyzes the traffic log 8050 toidentify only the features that are needed for determining whether aparticular event is anomalous. In some embodiments, a user, e.g., anadministrator associated with the network 8065, can provide the list offeatures to be tracked for determining whether an event is anomalous.The list of features to be tracked may be provided in the definition ofan event view.

The feature tracking module 8030 identifies the relevant features (i.e.,features of interest) and the values of each relevant feature occurringin the traffic log 8050 and stores a count of the occurrences of eachvalue of each relevant feature. For example, a feature such as the“port” field can occur multiple times in the traffic log 8050 someoccurrences of which can have the same value, e.g., same port number,and other occurrences of which can have other values. For example, afirst number of events in the traffic log 8050 can include portidentifier of 80 and a second number of events can have different portidentifiers, such as 20, 22, 23. Accordingly, the feature trackingmodule 8030 stores a count of the occurrences of values of a feature.Similarly, the feature tracking module 8030 stores a count of theoccurrences of values of other features. The feature tracking module8030 can store the count in a data structure that is convenient for easyand efficient storage and retrieval of the count data. The datastructure can be stored in a storage system associated with the system8025, e.g., persistence layer 368 of FIG. 3.

In some embodiments, the feature tracking module 8030 also tracksoccurrences of a set of features in an event, e.g., a feature pair. Asdescribed above, the technique can also determine how rare it is toobserve a first feature at a particular value when the second feature isobserved at a first value. For example, the technique can determine, indata transmission between two entities, how rare it is to observe asource zone as “Zone A” when the destination zone is “Zone B”. Thefeature tracking module 8030 can identify occurrences of such featurepairs and store a count of the occurrence of such feature pairs. Thefeature tracking module 8030 can store the count in a second datastructure that is convenient and efficient for easy storage andretrieval of the count data of the feature pairs. The second datastructure can be stored in a storage system associated with the system8025, e.g., persistence layer 368 of FIG. 3.

The rarity determination module 8035 determines a rarity score of eachparticular value of each relevant feature, where the score is indicativeof how rare it is to observe that particular value of the featurerelative to other values of the feature. To do so, the raritydetermination module 8035 first determines a probability of occurrenceof the particular value as a function of probabilities of other valuesof the feature that are as likely or less likely to occur than theparticular value. The probability of each of the possible values can bedetermined from the total observed number of occurrences of each valuein the event data in relation to the total number of occurrences of allvalues for that feature. The rarity determination module 8035 can obtaincount data 8045 of the feature, which includes counts of the numbers ofoccurrences of various values of the feature, from the feature trackingmodule 8030 or associated storage system.

After determining the probability of the particular value relative tothe other values of the feature as described above, the raritydetermination module 8035 computes a confidence interval of theprobability to obtain a rarity score 8070. The rarity determinationmodule 8035 can compute the confidence interval at an upper bound value,such as 95th percentile. In some embodiments, the rarity score is avalue between 0 and 1. The rarity determination module 8035 can use anyof various known methods, e.g., delta method, to compute the confidenceinterval. In some embodiments, computing the confidence interval isaccomplished by using the delta method, which ensures that the rarityscore 8070 is between 0 and 1.

As noted above, as one step in the rarity score computation, the raritydetermination module 8035 identifies the set of values of the featurewhose numbers of occurrences in the traffic log 8050 are less than orequal to the number of occurrences of the particular value in question.For the particular value, the rarity determination module 8035determines the sum of the number of occurrences of that set of valuesand the particular value, which is denoted as “k”. The raritydetermination module 8035 determines the total number of occurrences ofthe feature, which is denoted as “n”. The rarity determination module8035 determines the rarity score 8070 of the particular value of thefeature as a function of (k, n), e.g., as a confidence interval of thebinomial (k, n).

The following is an example describing determining the rarity score fora geographic (“geo”)-location feature, e.g., a location from where aconnection request to the network 8065 is originating, where each valueof the feature is a two-letter country identifier. Consider that thefeature tracking module 8030 has tracked the following numbers ofoccurrences of various values (country identifiers) for the geo-locationfeature: “US: 100, UK: 30, IN: 20, RU: 3, CN: 2, JP: 1.” For example,the events with value [US] for the geo location feature has occurred“100” times. The rarity determination module 8035 can compute the rarityof seeing the value [RU] as the sum of the probabilities of seeing (RU,CN, JP), where [CN] and [JP] in this example are values of thegeo-location that have appeared as many or fewer times than [RU]. Thesum of probabilities of (RU, CN, JP), which can indicate the relativeprobability of [RU], is used to determine the rarity score. The raritydetermination module 8035 can determine the rarity score as a confidenceinterval for the binomial (k=6 and n=156), where

k denotes the sum of occurrences of the particular value [RU] andoccurrences of the values that have appeared as many or fewer times than[RU], and

n denotes the total number of occurrences of the feature geo-location.

The rarity determination module 8035 can compute the rarity score as a95% confidence interval. The rarity score of [RU] indicates how rare itis to observe the value [RU] relative to other values for thegeo-location feature.

Similarly, the rarity determination module 8035 can also determine therarity score 8070 for feature pairs. The rarity determination module8035 can obtain the count data 8045 for the feature pair, determine therespective counts and then determine the rarity score 8070 for thefeature pair. For example, the rarity determination module 8035 candetermine a rarity score for observing a connection request for a givenapplication, such as a virtual private network (VPN), from a geolocation such as [RU]. The rarity determination module 8035 identifies aset of locations whose number of occurrences in the traffic log 8050 forthe VPN connection request is less than or equal to the number ofoccurrences of the [RU] location. The rarity determination module 8035determines a sum of the number of occurrences of the set of locationsand the location [RU], which is denoted as “k”. The rarity determinationmodule 8035 determines a total number of occurrences of the feature pairwith the application as VPN connection request, which is denoted as “n”.The rarity determination module 8035 determines the rarity score 8070 ofthe particular value of the feature as a function of (k, n), e.g., as95% confidence interval for the binomial (k, n).

Accordingly, the rarity determination module 8035 can determine therarity score 8070 for a particular value of the feature, and/or for afeature pair.

The anomaly detection module 8040 determines whether an activity inwhich the particular value of the feature occurred is anomalous based onwhether a rarity score criterion (e.g., one or more thresholds) issatisfied by the rarity score of the particular value. The raritycriterion can be a tuple of (score threshold, anomaly count threshold).The score threshold specifies a threshold for the rarity score and theanomaly count threshold specifies a threshold for the number of times aparticular value can be identified as an anomaly 8055. In someembodiments, the anomaly detection module 8040 can determine that aparticular value of the feature corresponds to an anomaly 8055 if therarity score 8070 of that particular value is below the score thresholdand the number of times that the particular value has been identified asan anomaly 8055 is below the anomaly count threshold.

If the number of times the particular value has been identified as ananomaly 8055 exceeds the anomaly count threshold, the anomaly detectionmodule 8040 may not identify the particular value as anomaly. In someembodiments, if the particular value has occurred enough times, e.g.,exceeds the anomaly count threshold, in a specified time interval, theanomaly detection module 8040 may determine that the particular value isno longer considered an anomaly and may, therefore, dynamically adjustthe rarity criterion, e.g., the score threshold and/or the anomaly countthreshold, to minimize and/or stop identifying the particular value ascorresponding to an anomaly.

The anomaly detection module 8040 can similarly determine whether anactivity in which a particular feature pair occurred is anomalous basedon whether the particular feature pair satisfies a rarity criterion.

As described above, in some embodiments, an event in the traffic log8050 can include a number of associated features. The anomaly detectionmodule 8040 may in some cases have to determine whether one or more ofthe features and/or feature pairs in an event is anomalous to determinewhether the event is anomalous.

FIG. 81 shows a table 8100 of example features and/or feature pairs tobe considered for determining whether an example event is anomalous. Theexample event can be a “cloudtrail” event 8105, which is an eventrepresentative of application programming interface (API) calls for aweb service. The cloudtrail event 8105 can include features such as:Event Class, which can be indicative of a class of the event; UserAgent, which can be indicative of a name of the application; Device,which can be an identification of a device (e.g., IP address) contactingthe web service, and User, which can be an identification of the userassociated with the device (e.g., username of the user). The table 8100indicates the features and the feature pairs that have to be analyzed todetermine whether the event corresponds to an anomaly 8055.

For example, the table 8100 indicates that the features, Event Class andUser Agent, and the feature pairs, (Event Class::Device), (EventClass::User), (User Agent::Device), and (User Agent::User) may have tobe analyzed to determine whether the cloudtrail event 8105 is an anomaly8055. That is, the anomaly detection module 8040 determines that thecloudtrail event 8105 corresponds to an anomaly if the above listedfeatures and the feature pairs satisfy the rarity criterion.

In some embodiments, the rarity criterion for determining whether anevent is anomalous can include additional parameters, such as a minimumnumber of features and/or feature pairs in the event to be anomalous, alist of features and/or feature pairs in the event to be anomalous.

FIG. 82 shows a table 8200 listing examples of thresholds and/orparameters of a rarity criterion, for various example events, that canbe used for determining whether an event is anomalous. The thresholds inthe table 8200 include a score threshold, a feature count threshold(which specifies the minimum number of features and/or feature pairs tobe anomalous) and an anomaly count threshold. The parameters in thetable 8200 can include rare features and/or rare feature pairs, whichindicate the features and/or feature pairs, respectively, that have tobe determined as anomalous to determine that the event itself isanomalous. The ignore feature indicates the features that when found tobe anomalous, results in ignoring the event, that is, the event is notto be identified as an anomaly.

For example, for an event such as transmitting data to/from anapplication via a port, a score threshold is set to “0.001,” a featurecount threshold is set to “1” and the anomaly count threshold is set to“50.” The rare features and rare feature pairs is set to null value. Theignore feature is set to null value.

It should be noted that one or more of the above thresholds areconfigurable, e.g., by a user, such as an administrator of the network8065, or by the system 8025. For example, the system 8025 maydynamically adjust the score threshold to a lower value if a significantnumber of occurrences of the particular value is identified as ananomaly, e.g., in a predefined period. Further, one or more of the aboveparameters are also configurable, e.g., by the user.

The anomaly detection module 8040 determines that a particular value ofa feature, a feature pair and/or an event is an anomaly 8055 if theparticular value, the feature pair and/or the event satisfies the raritycriterion.

After the anomaly detection module 8040 determines the particular value,feature pair and/or event to be anomalous, the anomaly detection module8040 indicates the particular value, feature pair and/or event as ananomaly 8055 to a threat analysis module 8060. The threat analysismodule 8060 can further analyze the anomaly 8055 to determine if it is athreat and raise an alarm, e.g., generate a notification, if it is one.The anomaly 8055 can include various information, e.g., rarity score8070 and/or information regarding various rarity criterion parameters,which can be used by the threat analysis module 8060 in determining ifthe anomaly 8055 is a threat.

FIG. 83 is a flow diagram of a process 8300 for determining an anomalybased on a rarity score for a particular value of a feature, consistentwith various embodiments. The process 8400 can be implemented in theenvironment 8000 and using the system 8025. The process 8300 can beperformed as part of a model in the real-time infrastructure 330 orbatch infrastructure 382. At block 8305, the feature tracking module8030 identifies the occurrence of a feature and one or more values ofthe feature in the traffic of a network, such as network 8065. Forexample, for an event data in the traffic log 8059 representing a VPNconnection request to a network 8065 from a user in a specific geolocation, the geo location can be a feature and the various possible geolocations such as [US], [UK], [IN] or [RU] can be values of the feature.The process 8300 can facilitate determining whether the occurrence of aparticular value of the feature is anomalous.

At block 8310, the feature tracking module 8030 identifies a set ofvalues of the feature whose probability of occurrence does not exceed aprobability of occurrence of the particular value. That is, the featuretracking module 8030 identifies the set of values that are as likely orless likely to occur in the traffic than the particular value of thefeature.

At block 8315, the rarity determination module 8035 determines a rarityscore for the particular value as a function of the probabilities of theoccurrence of the set of values, in the manner described above. Therarity score can indicate a probability of occurrence of the particularvalue relative to the set of values, i.e., how rare is the occurrence ofthe particular value relative to the set of values.

At determination block 8320, the anomaly detection module 8040determines whether the rarity score for the particular value of thefeature satisfies a rarity criterion. If the anomaly detection module8040 determines that the rarity score satisfies the rarity criterion, atblock 8325, the anomaly detection module 8040 determines that anactivity in the computer network associated with the particular value ofthe feature is anomalous. If the rarity score does not satisfy therarity criterion, the process 8300 returns.

In determining whether the rarity score satisfies the rarity criterion,the anomaly detection module 8040 determines whether the one or morethresholds of and/or parameters of the rarity criterion are satisfied.For example, the anomaly detection module 8040 can determine aparticular value of the feature as an anomaly if the rarity score forthe particular value is below a score threshold and a number of timesthe particular value has been identified as an anomaly is below ananomaly count threshold of the rarity criterion.

Further, the process 8300 can also be used to determine whether anobserved event of the traffic, which can include multiple features, isan anomaly based on a rarity score of the one or more features and/orfeature pairs. The anomaly detection module 8040 can determine whetherthe event is anomalous by determining whether one or more parameterssuch as a rarity score of the one or more features of the event, aminimum number of features in the event that need to be anomalous, or alist of features that need to be anomalous satisfy the rarity criterion.

FIG. 84 is a flow diagram of a process 8400 for determining a rarityscore for a particular value of a feature, consistent with variousembodiments. The process 8400 can be implemented in the environment 8000and using the system 8025. The process 8400 can also be performed aspart of a model in the real-time infrastructure 330 or batchinfrastructure 382. In some embodiments, the process 8400 can beperformed as part of blocks 8310 and 8315 of process 8300. At block8405, the feature tracking module 8030 identifies, from the traffic log8050, a set of values of the feature that has occurred as many or fewertimes than the particular value in the traffic. Consider that thefeature tracking module 8030 has tracked the following occurrences ofvarious values for a geo location feature: “US: 100, UK: 30, IN: 20, RU:3, CN: 2, JP: 1.” To determine a rarity score for the location “Russia,”i.e., for value [RU], the feature tracking module 8030 determines theset of locations that have occurred as many or fewer times than [RU],which are “China,” i.e., [CN] and “Japan,” i.e., [JP]. The featuretracking module 8030 determines the sum of occurrences of the particularvalue [RU] and the set of values, [CN] and [JP], as (k=6).

At block 8410, the feature tracking module 8030 determines a totalnumber of occurrences of the feature. Continuing with the above example,the feature tracking module 8030 determines the total number ofoccurrences of the geo location feature, which includes occurrences ofall values of the feature, as (n=156).

At block 8415, the rarity determination module 8035 determines therarity score for the particular value by computing a confidence intervalfor the parameters (k, n). In some embodiments, the rarity score iscomputed as an upper bound confidence interval, e.g., 95% confidenceinterval, of the parameters. The confidence interval method employed forcomputing the rarity score can be selected such that the rarity score iscomputed to a value between 0 and 1. In some embodiments, the raritydetermination module 8035 employs a delta method for computing theconfidence interval.

Continuing with the above example, the rarity determination module 8035can determine the rarity score for [RU] as 95% th confidence interval ofparameters (k=6 and n=156). The rarity score for [RU] indicates how rareit is to observe an occurrence of the geo location as [RU] relative toother locations.

Reference in this specification to “one embodiment” or “an embodiment”means that a particular feature, structure, or characteristic describedin connection with the embodiment is included in at least one embodimentof the disclosure. The appearances of the phrase “in one embodiment” invarious places in the specification are not necessarily all referring tothe same embodiment, nor are separate or alternative embodimentsmutually exclusive of other embodiments. Moreover, various features aredescribed which may be exhibited by some embodiments and not by others.Similarly, various requirements are described which may be requirementsfor some embodiments but not for other embodiments.

Computer System Device Architecture

A security platform such as described above (e.g., security platform300) can be implemented using one or more conventional physicalprocessing devices. FIG. 85 is a block diagram showing an example ofsuch a processing device, e.g., a computer system 8500. Multipleinstances of such a computer system may be used to implement thesecurity platform in a given embodiment.

In an illustrative embodiment, computer system 8500 includes one or moreprocessor(s) 8510, memory 8520, one or more input/output (I/O) devices8530, a network adapter 8540, and a storage adapter 8550, allinterconnected by an interconnect 8560. Memory 8520 includes storagelocations that are addressable by processor(s) 8510 and adapters 8540and 8550 for storing software program code and data structuresassociated with the techniques introduced here. Memory 8520 may includemultiple physically distinct memory devices, which may be all of thesame type or of different types (e.g., volatile memory such as SRAM orDRAM, non-volatile memory such as flash, etc.). Processor(s) 8510 andadapters 8540 and 8550 may, in turn, include processing elements and/orlogic circuitry configured to execute the software code and manipulatethe data structures. It will be apparent to those skilled in the artthat other processing and memory implementations, including variousmachine-readable storage media, may be used for storing and executingprogram instructions pertaining to the techniques introduced here.

Network adapter 8540 includes one or more ports to couple computersystem 8500 with one or more other devices over one or morepoint-to-point links, local area networks (LANs), wide area networks(WANs), the global Internet, virtual private networks (VPNs) implementedover a public network, or the like. Network adapter 8540 can include themechanical components and electrical circuitry needed to connect storageserver 8500 to a network. One or more systems can communicate with othersystems over the network by exchanging packets or frames of dataaccording to pre-defined protocols, such as TCP/IP.

Storage adapter 8550 interfaces with an operating system running onprocessor(s) 8510 to access information on attached storage devices. Theinformation may be stored on any type of attached array of writablestorage media, such as hard disk drives, magnetic tape, optical disk,flash memory, solid-state drives, RAM, MEMs and/or any other similarmedia adapted to store information. Storage adapter 8550 includes aplurality of ports having I/O interface circuitry that couples withdisks or other storage related devices over an I/O interconnectarrangement.

CONCLUSION

Embodiments of the techniques introduced here include various steps andoperations, which have been described above. A variety of these stepsand operations may be performed by hardware components or may beembodied in machine-executable instructions, which may be used to causeone or more general-purpose or special-purpose processors programmedwith the instructions to perform the steps. Alternatively, the steps maybe performed by a combination of hardware, software, and/or firmware.

Embodiments of the techniques introduced here may be implemented, atleast in part, by a computer program product which may include anon-transitory machine-readable medium having stored thereoninstructions that may be used to program/configure a computer or otherelectronic device to perform some or all of the operations describedabove. The machine-readable medium may include, for example, magnetichard disk drives, compact disc read-only memories (CD-ROMs),magneto-optical disks, floppy disks, ROMs, RAMs, various forms oferasable programmable read-only memories (EPROMs), magnetic or opticalcards, flash memory, or other type of machine-readable medium suitablefor storing electronic instructions. Moreover, embodiments of thepresent invention may also be downloaded as a computer program product,wherein the program may be transferred from a remote computer to arequesting computer by way of data signals embodied in a carrier wave orother propagation medium via a communication link.

What is claimed is:
 1. A method comprising: receiving, by a computersystem, first event data indicative of computer network activity of aplurality of users and network devices in a computer network;generating, by the computer system, classification metadata for each ofthe network devices and users, based on the first event data, toindicate relevance in a network security context of each of the usersand network devices; identifying, by the computer system, usagerelationships between one or more of the users and one or more of thenetwork devices, based on first event data; assigning, by the computersystem, usage similarity scores to the network devices based on theidentified usage relationships, the usage similarity scores beingindicative of which of the network devices have been used by the same orsimilar group of users; receiving, by the computer system, second eventdata indicative of computer network activity of a particular user of theplurality of users; and detecting, by the computer system and inresponse to the second event data, an anomaly indicative that theparticular user has interacted with a particular network device withwhich the particular user does not normally interact, based on the usagesimilarity scores and the classification metadata.
 2. The method ofclaim 1, further comprising: retrieving a graph data structure thatrecords anomalies in the network and the relationships between theanomalies and the users and network devices; identifying a securitythreat based on the detected anomaly by identifying, in the graph datastructure, a relationship path in the data structure from the particularuser to a network device designated as a critical resource of thenetwork, the relationship path including users and network devicesinterlinked by anomalies; and reporting the security threat to anadministrator of the network.
 3. The method of claim 1, furthercomprising: retrieving a graph data structure that records anomalies inthe network and the relationships between the anomalies and the usersand network devices, the graph data structure including nodesinterconnected by edges, the nodes representing the entities, the edgesrepresenting usage relationships between the entities; identifying asecurity threat based on the detected anomaly by identifying, in thegraph data structure, a relationship path from the particular userthrough one or more anomalies in the data structure to a network devicedesignated as a critical resource of the network; and reporting thesecurity threat to an administrator of the network.
 4. The method ofclaim 1, further comprising: determining that the detected anomaly isindicative of a suspicious lateral movement of the particular user inthe network.
 5. The method of claim 1, wherein the relationships betweenthe users and the network devices include login events indicative of theusers logging into the network devices
 6. The method of claim 1, whereinsaid assigning similarity scores is performed such that any first set ofnetwork devices that are accessed by the same or similar group of usersare assigned similarity scores that are closer in value to each otherthan similarity scores of any second set of network devices that are notaccessed by the same or similar group of users.
 7. The method of claim1, wherein said assigning similarity scores comprises: assigningsimilarity scores to the network devices based on login eventsindicative of users accessing the network devices, such that a firstgroup of network devices that have similar groups of login users havesimilarity scores that are closer in value to each other than similarityscores of network devices that do not have similar groups of loginusers.
 8. The method of claim 1, wherein said detecting an anomalycomprises: detecting an anomaly in response to detecting that anparticular user has interacted with a particular network device when asimilarity score of the particular network device fails to satisfy aspecific closeness criterion relative to similarity scores of networkdevices with which the particular user usually interacts.
 9. The methodof claim 1, wherein the classification metadata for a particular userincludes metadata indicative of the particular user being at least oneof a regular user, an administrative user, or an automated user.
 10. Themethod of claim 1, wherein the classification metadata for a particularnetwork device includes metadata indicative of the particular networkdevice being at least one of a workstation, a server or a printer. 11.The method of claim 1, wherein the relationships between the users andthe network devices form a bipartite graph including a first set of theusers and a second set of the network devices.
 12. The method of claim1, wherein the relationships between the users and the network devicesrepresent a time series of events in which the users have interactedwith the network devices.
 13. The method of claim 1, wherein saidassigning similarity scores comprises: distributing weight values with aprobability percentage along edges between the users and the networkdevices; and repeating the distributing along edges until the weightvalues at the network devices converge; and assigning similarity scoresto the network device based on the converged weight values.
 14. Themethod of claim 1, wherein said assigning similarity scores comprises:forming a bipartite graph having nodes representing the users and thenetwork device and edges representing the relationships between theusers and the network devices; assigning an initial weight value to anode of the bipartite graph; keeping a percentage of the initial weightvalue at the node and equally distributing a remainder of the initialweight value from the node along edges of the node to other nodes; ateach node, repeating a process until a weight value at each nodeconverges, the process including: summing weight values at each node ofthe bipartite graph, and keeping the percentage of a previouslydistributed weight value at the node and equally distributing aremainder of the weight value from the node along edges of the node toother nodes; and assigning similarity scores to the network devicesbased on the converged weight values at the nodes representing thenetwork devices.
 15. The method of claim 1, wherein said assigningsimilarity scores comprises: assigning similarity scores to the networkdevices based on relationships between the users and the networkdevices, such that particular network devices having multiple exclusiveusers interacting with only the particular network devices tend to havesimilarity scores that have differences less than a threshold value. 16.The method of claim 1, wherein said assigning similarity scorescomprises: assigning similarity scores to the network devices based onrelationships between the users and the network devices, such thatparticular network devices having only a single shared user interactingwith all of the particular network devices have different similarityscores.
 17. The method of claim 1, wherein said detecting an anomalycomprises: detecting that the particular user has interacted with theparticular network device; calculating an anomaly score for theparticular user based on a difference between a similarity score of theparticular network device and a statistical measure of similarity scoresof other network devices with which the user has interacted; anddetecting the anomaly in response to detecting that the anomaly scoreexceeds an anomaly threshold value.
 18. The method of claim 1, whereinsaid detecting an anomaly comprises: determining an access profile ofthe particular user including network devices with which the particularuser interacts and that have similarity scores that satisfy a specificcloseness criterion; in response to the particular user interacting witha particular network device, calculating an anomaly score for theparticular user based on a difference between a similarity score of theparticular network device and an average of similarity scores of networkdevices in the access profile of the particular user; and detecting theanomaly in response to detecting that the similarity score differenceindicates that the particular user has interacted with the particularnetwork device outside of the access profile of the particular user. 19.The method of claim 1, wherein said detecting an anomaly comprises:determining an access profile of the particular user including networkdevices with which the particular user interacts and that havesimilarity scores that satisfy a specific closeness criterion; andwherein the access profile of the particular user further includesinformation of events indicative that the particular user has loggedinto a network device, validated credential of a network device, oraccessed a network object stored on a network device.
 20. The method ofclaim 1, wherein said detecting an anomaly comprises: determining anaccess profile of the particular user including network devices withwhich the particular user interacts and that have similarity scores thatsatisfy a specific closeness criterion; and wherein the access profileof the particular user further includes information of events indicativethat the particular user has succeeded logging in to a network device,failed logging in to a network device, succeeded validating credentialof a network device, failed validating credential of a network device,succeeded accessing a network object stored on a network device, orfailed accessing a network object stored on a network device.
 21. Themethod of claim 1, wherein said detecting an anomaly comprises:identifying a first group including network devices with which theparticular user interacts and that have similarity scores that satisfy aspecific closeness criterion; identifying a second group including a newnetwork device with which the particular user interacts; and detectingan out-of-profile anomaly in response to determining that the particularuser is the only user who has interacted with both the first and secondgroups.
 22. The method of claim 1, further comprising: identifying asecurity threat based on the detected anomaly by identifying arelationship path from the particular user through one or more anomaliesto a network device designated as a critical resource of the network,the critical resource being a server responsible for handling securityauthentication requests for the network.
 23. The method of claim 1,further comprising: identifying a security threat based on the detectedanomaly by identifying a relationship path from the particular userthrough one or more anomalies to a network device designated as acritical resource of the network, the security treat indicative that anunauthorized user has misappropriated a credential of the particularuser to enter the network and breached one or more network devices alongthe relationship path to access the critical resource.
 24. The method ofclaim 1, wherein the first event data is machine data.
 25. The method ofclaim 1, wherein the first event data is timestamped machine data. 26.The method of claim 1, wherein said generating classification metadataor said assigning usage similarity scores are performed by a machinelearning model.
 27. The method of claim 1, wherein said generatingclassification metadata or said assigning usage similarity scores areperformed in real time as the first event data are received.
 28. Themethod of claim 1, wherein said generating classification metadata orsaid assigning usage similarity scores are performed in batch mode basedon the first event data being retrieved from a persistent storagefacility.
 29. A computing device comprising: a processor; and a memorystoring instructions that, when executed by the processor, cause thecomputing device to perform a process including: receiving first eventdata indicative of computer network activity of a plurality of users andnetwork devices in a computer network; generating classificationmetadata for each of the network devices and users, based on the firstevent data, to indicate relevance in a network security context of eachof the users and network devices; identifying usage relationshipsbetween one or more of the users and one or more of the network devices,based on first event data; assigning usage similarity scores to thenetwork devices based on the identified usage relationships, the usagesimilarity scores being indicative of which of the network devices havebeen used by the same or similar group of users; receiving second eventdata indicative of computer network activity of a particular user of theplurality of users; and in response to the second event data, detectingan anomaly indicative that the particular user has interacted with aparticular network device with which the particular user does notnormally interact, based on the usage similarity scores and theclassification metadata.
 30. A non-transitory machine readable storagemedium storing instructions, execution of which in a machine causes themachine to perform a process including: receiving, by the machine, firstevent data indicative of computer network activity of a plurality ofusers and network devices in a computer network; generating, by themachine, classification metadata for each of the network devices and theusers, based on the first event data, to indicate relevance in a networksecurity context of each of the users and the network devices;identifying, by the machine, usage relationships between one or more ofthe users and one or more of the network devices, based on first eventdata; assigning, by the machine, usage similarity scores to the networkdevices based on the identified usage relationships, the usagesimilarity scores being indicative of which of the network devices havebeen used by the same or similar group of users; receiving, by themachine, second event data indicative of computer network activity of aparticular user of the plurality of users; and detecting, by the machineand in response to the second event data, an anomaly indicative that theparticular user has interacted with a particular network device withwhich the particular user does not normally interact, based on the usagesimilarity scores and the classification metadata.